Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.test.tsx

@@ -793,6 +793,23 @@ describe("ServerSettingsForm", () => {
     expect(arg.scopes).toBe("read");
   });
 
+  it("calls onClearStoredOAuth from the OAuth section", async () => {
+    const user = userEvent.setup();
+    const onClearStoredOAuth = vi.fn();
+    renderWithMantine(
+      <ServerSettingsForm
+        {...baseHandlers}
+        settings={populatedSettings}
+        expandedSections={["oauth"]}
+        onClearStoredOAuth={onClearStoredOAuth}
+      />,
+    );
+    await user.click(
+      screen.getByRole("button", { name: "Clear stored OAuth state" }),
+    );
+    expect(onClearStoredOAuth).toHaveBeenCalledTimes(1);
+  });
+
   it("clears a metadata value via its Clear button (onMetadataChange with empty value)", async () => {
     const user = userEvent.setup();
     const onMetadataChange = vi.fn();

clients/web/src/components/groups/ServerSettingsForm/ServerSettingsForm.tsx

@@ -3,6 +3,7 @@ import {
   ActionIcon,
   Button,
   Checkbox,
+  Flex,
   Group,
   NumberInput,
   Stack,
@@ -56,6 +57,7 @@ export interface ServerSettingsFormProps {
   onAutoRefreshChange: (value: boolean) => void;
   onMaxFetchRequestsChange: (value: number) => void;
   onOAuthChange: (oauth: OAuthSettings) => void;
+  onClearStoredOAuth?: () => void;
   onAddRoot: () => void;
   onRemoveRoot: (index: number) => void;
   onRootChange: (index: number, uri: string, name: string) => void;
@@ -82,6 +84,20 @@ const EmptyHint = Text.withProps({
   fs: "italic",
 });
 
+const ClearStoredOAuthButton = Button.withProps({
+  variant: "light",
+  color: "red",
+  size: "compact-sm",
+  flex: "0 0 auto",
+});
+
+const ClearStoredOAuthHint = Text.withProps({
+  size: "sm",
+  c: "dimmed",
+  flex: 1,
+  miw: "12rem",
+});
+
 function KeyValueRows({
   items,
   onChange,
@@ -204,6 +220,7 @@ export function ServerSettingsForm({
   onAutoRefreshChange,
   onMaxFetchRequestsChange,
   onOAuthChange,
+  onClearStoredOAuth,
   onAddRoot,
   onRemoveRoot,
   onRootChange,
@@ -494,6 +511,17 @@ export function ServerSettingsForm({
                   ) : null
                 }
               />
+              {onClearStoredOAuth ? (
+                <Flex align="flex-start" gap="sm" wrap="wrap">
+                  <ClearStoredOAuthButton onClick={onClearStoredOAuth}>
+                    Clear stored OAuth state
+                  </ClearStoredOAuthButton>
+                  <ClearStoredOAuthHint>
+                    Removes stored tokens and client registration for this
+                    server. Disconnects if this server is currently connected.
+                  </ClearStoredOAuthHint>
+                </Flex>
+              ) : null}
             </Stack>
           </Accordion.Panel>
         </Accordion.Item>