When adding an MCP server from an OpenAPI specification and selecting Bearer Token authentication, the dashboard returns a 401 even with a valid token. The same spec URL loads correctly in Postman when the Authorization header is sent, which points at LiteLLM rather than the upstream API.

The root cause is that LiteLLM downloads the OpenAPI document (`spec_path`) without forwarding the configured credential. `load_openapi_spec_async` issues a plain GET with no Authorization header, both in the dashboard tools preview (`/v1/mcp/server/test/tools/list`) and in the server registration path in `mcp_server_manager._register_openapi_tools`. When the spec URL is hosted behind the same credential as its endpoints, which is the common case, the upstream replies 401 and the server can never be added.

This is separate from the request-time `extra_headers` forwarding addressed in #27383 and #26864; that work only covers headers sent while executing a tool, not the spec fetch itself, so the spec download was still going out unauthenticated.

To reproduce, serve an OpenAPI spec behind a Bearer token, then in the dashboard add a new MCP server from that spec URL, choose Bearer Token, and paste …