fix: address coderabbit review findings

src/wf_mcp/broker/service/source_registry_admin.py

@@ -164,7 +164,7 @@ class SourceRegistryAdminProvider(WorkflowSourceRegistryMutationProvider):
             for source_id in sorted(after):
                 diagnostic = connection_auth_diagnostic(
                     after[source_id],
-                    load_auth=self.load_auth,
+                    load_auth_ref=self.load_auth,
                 )
                 if diagnostic is not None:
                     auth_diagnostics.append(diagnostic.model_dump(mode="json"))

src/wf_mcp/broker/service/upstream_transport.py

@@ -312,7 +312,9 @@ class UpstreamTransportService:
                 continue
             auth_diagnostic = connection_auth_diagnostic(
                 connection,
-                load_auth=self.load_auth,
+                # The diagnostic helper passes the explicit auth_ref to this
+                # loader, matching load_connection_auth's auth_ref-first path.
+                load_auth_ref=self.load_auth,
                 logical_ref=logical_ref,
             )
             if auth_diagnostic is not None: