## Bug description

`POST /key/update` on any key whose `object_permission` row contains a stale reference to a deleted MCP server fails with:

``` 403 Forbidden — "Key is not in a team / allowed servers" ```

## Root cause

`handle_update_object_permission_common` in `litellm/proxy/management_helpers/object_permission_utils.py` does a plain `dict.update` to merge the stored `mcp_servers` list with the incoming request data, then writes the merged result back via upsert. If the DB record contains the UUID of a server that was deleted from `LiteLLM_MCPServerTable`, that UUID is never cleaned out. The re-validation step on every subsequent `/key/update` call produces the 403.

The same applies to server UUIDs stored as keys in `mcp_tool_permissions`.

## Steps to reproduce

1. Register an MCP server — note its UUID. 2. Assign it to a key via `object_permission.mcp_servers`. 3. Delete the MCP server from the LiteLLM database. 4. Call `POST /key/update` with any field change. 5. Observe: `403 — Key is not in a team / allowed servers`.

## Fix

Branch `fix/stale-mcp-server-key-update` in fork https://github.com/sumirjha/litellm.

**Files:** - `litellm/proxy/management_helpers/object_per…