fix: address Copilot review on the _meta widening

- Widen the three `_meta` annotations the bulk pass missed, all of them
  return types rather than identifier declarations: `mergeMeta`,
  `aggregateListParams`, and the `tools/call` params object. The second was
  unsound in a way callers could see — it advertised
  `{ _meta: Record<string, string> }` while the runtime carried nested JSON.

- `normalizeStoredMetadata`: keep an explicit `null` from a legacy pair
  instead of folding it into `""` (only a missing `value` defaults now), and
  store through `Object.defineProperty` so a legacy `__proto__` key becomes an
  own property rather than hitting the prototype setter.

- Drop the unjustified `as unknown as` from the migration test; the legacy
  fixture is untyped and cast once where it crosses into the typed parser.

- The TUI settings test asserted only that the app mounted, so it could not
  have caught a pair array being forwarded as numeric `_meta` keys. The fake
  client now captures its constructor options and the test asserts the nested
  object arrives intact.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/serverList.ts

@@ -234,7 +234,19 @@ export function normalizeStoredMetadata(
       }
       const { key, value } = entry as { key: string; value?: JsonValue };
       if (key.trim() === "") continue;
-      out[key] = value ?? "";
+      // `??`, not `||`: `null` is a legal `_meta` value and must survive the
+      // migration as `null`. Only a genuinely absent `value` becomes `""`.
+      //
+      // `defineProperty` rather than `out[key] = …` because a legacy key of
+      // `__proto__` would otherwise hit the prototype setter — silently
+      // dropping the entry (or, for an object value, mutating the prototype)
+      // instead of storing an own property under that name.
+      Object.defineProperty(out, key, {
+        value: value === undefined ? "" : value,
+        writable: true,
+        enumerable: true,
+        configurable: true,
+      });
     }
     return out;
   }