Guided-auth removal, OAuth smoke testing, and TUI/CLI support (#1531)

* refactor(web): update OAuth E2E tests to use new authentication method

- Replaced `runGuidedAuth` with `authenticate` in the InspectorClient OAuth end-to-end tests to support quick authentication with CIMD pre-registration.
- Updated comments to reflect the change in authentication method and its support for HTTP test metadata URLs.
- Ensured that the tests continue to validate the expected authorization URL after the change.

Additionally, imported `ensureCimdClientRegistration` in the OAuthManager to streamline client registration during the authentication process.

* Guided-auth removal, OAuth smoke testing, and TUI/CLI support

* Added CLI OAuth runner flags tests

* Added clarifying comment on port 0 binding

* README notes on TUI oauth callback port, prettier fixes for CLI tests

* CIMD validation uses inline like EMA IdP

* Fixed TUI test failures from merge

* test: bring 5 OAuth files over the 90 per-file coverage gate

The guided-auth-removal work added/touched several files that fell below
the repo's >=90 per-file coverage gate (npm run coverage). CI doesn't run
the gate (it's local-only), so validate + test:integration passed while
these gaps slipped through. Bring them all back over the line:

- core/auth/node/runner-oauth-callback.ts: test bad-URL/non-http-scheme
  throws, no-port->80 default, and IPv6 hostname bracketing. Annotate the
  provably-dead guards (empty host, out-of-range port, String(err)
  fallback, pathname "/" fallback) -- all rejected by new URL() upstream --
  with justified v8 ignore comments instead of lowering the gate.
- core/auth/cimd.ts: test the AS-doesn't-support-CIMD early return.
- core/react/useClientSettingsDraft.ts: test the functional-updater path,
  the stale-onChange-after-close prev===null guard, and the
  timer-fires-after-close value===null guard.
- ClientSettingsForm.tsx: test the CIMD checkbox toggle and CIMD URL clear.
- clients/tui/src/utils/oauthDisplay.ts: test static/dcr registration
  kinds, the expired IdP session, and the configured-scope/empty-scope
  branches of formatScopes.

npm run coverage now passes (exit 0) across web, cli, tui, launcher.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: cliffhall <cliff@futurescale.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

core/react/useClientSettingsDraft.ts

@@ -18,7 +18,7 @@ export interface UseClientSettingsDraftOptions<T> {
 
 export interface UseClientSettingsDraftResult<T> {
   draft: T | null;
-  onChange: (next: T) => void;
+  onChange: (next: T | ((prev: T) => T)) => void;
   flush: () => void;
 }
 
@@ -31,24 +31,26 @@ export function useClientSettingsDraft<T>({
 }: UseClientSettingsDraftOptions<T>): UseClientSettingsDraftResult<T> {
   const [draft, setDraft] = useState<T | null>(null);
   const timerRef = useRef<ReturnType<typeof setTimeout> | undefined>(undefined);
+  const latestValuesRef = useRef<T | null>(null);
 
   const resolveInitialRef = useRef(resolveInitial);
   const onPersistRef = useRef(onPersist);
   const onErrorRef = useRef(onError);
-  const draftRef = useRef<T | null>(null);
   const openedRef = useRef(opened);
   resolveInitialRef.current = resolveInitial;
   onPersistRef.current = onPersist;
   onErrorRef.current = onError;
-  draftRef.current = draft;
   openedRef.current = opened;
 
   useEffect(() => {
     if (!opened) {
       setDraft(null);
+      latestValuesRef.current = null;
       return;
     }
-    setDraft(resolveInitialRef.current());
+    const initial = resolveInitialRef.current();
+    setDraft(initial);
+    latestValuesRef.current = initial;
   }, [opened]);
 
   useEffect(() => {
@@ -67,13 +69,23 @@ export function useClientSettingsDraft<T>({
   }, []);
 
   const onChange = useCallback(
-    (next: T) => {
+    (next: T | ((prev: T) => T)) => {
       if (!opened) return;
-      setDraft(next);
+      const prev = latestValuesRef.current;
+      if (prev === null) return;
+      const resolved =
+        typeof next === "function"
+          ? (next as (prev: T) => T)(prev)
+          : next;
+      latestValuesRef.current = resolved;
+      setDraft(resolved);
       if (timerRef.current) clearTimeout(timerRef.current);
       timerRef.current = setTimeout(() => {
         timerRef.current = undefined;
-        persist(next);
+        const value = latestValuesRef.current;
+        if (value !== null) {
+          persist(value);
+        }
       }, debounceMs);
     },
     [opened, debounceMs, persist],
@@ -83,7 +95,7 @@ export function useClientSettingsDraft<T>({
     if (!timerRef.current) return;
     clearTimeout(timerRef.current);
     timerRef.current = undefined;
-    const value = draftRef.current;
+    const value = latestValuesRef.current;
     if (openedRef.current && value !== null) {
       persist(value);
     }