fix: address coderabbit review findings

src/wf_mcp/auth.py

@@ -112,7 +112,7 @@ def auth_missing_diagnostic(
 def connection_auth_diagnostic(
     connection: ConnectionConfig,
     *,
-    load_auth: Callable[[str], AuthRecord | None],
+    load_auth_ref: Callable[[str], AuthRecord | None],
     logical_ref: str | None = None,
 ) -> DependencyDiagnostic | None:
     """Return an auth diagnostic for explicit auth_ref misses.
@@ -125,7 +125,7 @@ def connection_auth_diagnostic(
     auth_ref = auth_ref_for_connection(connection)
     if auth_ref is None:
         return None
-    if load_auth(auth_ref) is not None:
+    if load_auth_ref(auth_ref) is not None:
         return None
     return auth_missing_diagnostic(
         auth_ref=auth_ref,

src/wf_mcp/broker/service/source_registry_admin.py

@@ -164,7 +164,7 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
             for source_id in sorted(after):
                 diagnostic = connection_auth_diagnostic(
                     after[source_id],
-                    load_auth=self.load_auth,
+                    load_auth_ref=self.load_auth,
                 )
                 if diagnostic is not None:
                     auth_diagnostics.append(diagnostic.model_dump(mode="json"))

src/wf_mcp/broker/service/upstream_transport.py

@@ -312,7 +312,9 @@ class UpstreamTransportService:
                 continue
             auth_diagnostic = connection_auth_diagnostic(
                 connection,
-                load_auth=self.load_auth,
+                # The diagnostic helper passes the explicit auth_ref to this
+                # loader, matching load_connection_auth's auth_ref-first path.
+                load_auth_ref=self.load_auth,
                 logical_ref=logical_ref,
             )
             if auth_diagnostic is not None: