feat: oauth tokens stored in aws secrets / parameters or mongodb

[owengo]

Pull Request Template

⚠️ Before Submitting a PR, Please Review:

• Please ensure that you have thoroughly read and understood the Contributing Docs before submitting your Pull Request.

⚠️ Documentation Updates Notice:

• Kindly note that documentation updates are managed in this repository: librechat.ai

Summary

The change implements an interface to store oauth tokens / refresh_tokens in aws secrets or aws parameters ( free! ) instead of the mongodb database.

It's a proposal for:
#9864

Imagine you have a mcp server like "google_workspace_mcp" on your instance, the refresh_tokens ( ie: permanent, never expiring passwords-like ) for all the critical google workspace feature for all of your user will be stored in the database. If, for some reason you're not at ease with that this PR allows to store in aws secret or aws parameters instead, where you can manage access / audit etc.

Change Type

Please delete any irrelevant options.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• Translation update

Testing

The librechat backend must have access to the storage ( aws secrets or aws parameters ) you choose, there are various ways for this.

Then, when you use an MCP server with oauth, verify the tokens are stocked on the cloud storage instead of the database.

Test Configuration:

Checklist

Please delete any irrelevant options.

At this time this PR is a draft but it's fully functional

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• I have made pertinent documentation changes
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes
• Any changes dependent on mine have been merged and published in downstream modules.
• A pull request for updating the documentation has been submitted.