Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/test/integration/server/vite-base-config.test.ts

@@ -1,5 +1,18 @@
-import { describe, it, expect } from "vitest";
-import { getViteBaseConfig } from "../../../../server/vite-base-config.js";
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import {
+  mkdtempSync,
+  mkdirSync,
+  writeFileSync,
+  existsSync,
+  rmSync,
+} from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import {
+  clearViteDepsCache,
+  getViteBaseConfig,
+  getViteDevOptimizeDeps,
+} from "../../../../server/vite-base-config.js";
 
 describe("getViteBaseConfig", () => {
   it("excludes node-only deps from optimizeDeps so vite dev doesn't scan them", () => {
@@ -21,3 +34,41 @@ describe("getViteBaseConfig", () => {
     expect(a.optimizeDeps).not.toBe(b.optimizeDeps);
   });
 });
+
+describe("getViteDevOptimizeDeps", () => {
+  it("forces a full pre-bundle on each dev launch with no stale-request 504s", () => {
+    const config = getViteDevOptimizeDeps();
+    expect(config.force).toBe(true);
+    expect(config.ignoreOutdatedRequests).toBe(true);
+    expect(config.include).toEqual([
+      "ajv",
+      "@modelcontextprotocol/sdk/validation/ajv",
+    ]);
+    expect(config.exclude).toEqual(getViteBaseConfig().optimizeDeps.exclude);
+  });
+});
+
+describe("clearViteDepsCache", () => {
+  let tempRoot: string;
+
+  beforeEach(() => {
+    tempRoot = mkdtempSync(join(tmpdir(), "vite-cache-clear-"));
+    mkdirSync(join(tempRoot, "node_modules", ".vite", "deps"), {
+      recursive: true,
+    });
+    writeFileSync(
+      join(tempRoot, "node_modules", ".vite", "deps", "metadata.json"),
+      "{}",
+    );
+  });
+
+  afterEach(() => {
+    rmSync(tempRoot, { recursive: true, force: true });
+  });
+
+  it("removes node_modules/.vite before a dev server start", () => {
+    expect(existsSync(join(tempRoot, "node_modules", ".vite"))).toBe(true);
+    clearViteDepsCache(tempRoot);
+    expect(existsSync(join(tempRoot, "node_modules", ".vite"))).toBe(false);
+  });
+});