### What happened

We run an MCP server behind the proxy with `auth_type: oauth2` and `delegate_auth_to_upstream` (upstream is Authentik). It works until the upstream refresh token expires. After that the client's refresh fails and never recovers; it just retries the same dead token.

The cause is in `exchange_token_with_server` (`litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py`). That function POSTs to the upstream `token_url` and calls `response.raise_for_status()` on the result, with no surrounding try/except. `token_endpoint`, which calls it, doesn't catch anything either. When the upstream returns `400 invalid_grant` for an expired or rotated refresh token, `raise_for_status()` throws and the client receives an opaque 500 instead of the OAuth error.

The client needs that `invalid_grant` to know it should drop the refresh token and start a new authorization flow. With a 500 it can't tell what happened, so a headless client (no interactive re-auth) loops on the dead token until someone re-authenticates by hand.

### Logs

Proxy side, the upstream 400 surfaces as a masked 500:

``` File ".../litellm/proxy/_experimental/mcp_server/discoverable_endpoints.py", line…