Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/client/config-parse.ts

@@ -54,6 +54,76 @@ const HttpUrlStringSchema = z
     }
   });
 
+/** Field-level error when a CIMD metadata URL is not a parseable http(s) URL. */
+export const CIMD_METADATA_URL_INVALID_ERROR =
+  "Must be a valid URL, like https://example.com/oauth/client.json";
+
+/** Field-level error when a CIMD metadata URL is not HTTPS. */
+export const CIMD_METADATA_URL_HTTPS_ERROR =
+  "CIMD client metadata URL must use HTTPS";
+
+/** Field-level error when a CIMD metadata URL has no path segment. */
+export const CIMD_METADATA_URL_PATH_ERROR =
+  "Must include a path (not the site root), like https://example.com/oauth/client.json";
+
+/**
+ * Inline / form validation for a non-empty CIMD client metadata URL.
+ * Returns undefined when the value is valid; empty strings are not flagged here
+ * (required-field gating lives in {@link canPersistClientSettingsDraft}).
+ */
+export function getCimdClientMetadataUrlError(value: string): string | undefined {
+  const trimmed = value.trim();
+  if (trimmed === "") return undefined;
+  if (!isAbsoluteHttpUrl(trimmed)) {
+    return CIMD_METADATA_URL_INVALID_ERROR;
+  }
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:") {
+      return CIMD_METADATA_URL_HTTPS_ERROR;
+    }
+    if (url.pathname === "/" || url.pathname === "") {
+      return CIMD_METADATA_URL_PATH_ERROR;
+    }
+  } catch {
+    return CIMD_METADATA_URL_INVALID_ERROR;
+  }
+  return undefined;
+}
+
+function refineCimdMetadataUrl(
+  val: string,
+  ctx: z.RefinementCtx,
+  required: boolean,
+): void {
+  const trimmed = val.trim();
+  if (trimmed === "") {
+    if (required) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: "CIMD client metadata URL is required when CIMD is enabled",
+      });
+    }
+    return;
+  }
+  const error = getCimdClientMetadataUrlError(trimmed);
+  if (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: error,
+    });
+  }
+}
+
+const CimdConfigSchema = z
+  .object({
+    enabled: z.boolean(),
+    clientMetadataUrl: z.string(),
+  })
+  .superRefine((data, ctx) => {
+    refineCimdMetadataUrl(data.clientMetadataUrl, ctx, data.enabled === true);
+  });
+
 const EnterpriseManagedAuthIdpConfigSchema = z.object({
   issuer: HttpUrlStringSchema,
   clientId: z.string().min(1),
@@ -67,6 +137,7 @@ const ClientConfigSchema = z.object({
       idp: EnterpriseManagedAuthIdpConfigSchema,
     })
     .optional(),
+  cimd: CimdConfigSchema.optional(),
 });
 
 /**