refactor: remove unsafe non-null assertions / double-cast in auth paths

Address the TypeScript-safety review items on the mid-session auth work:

- oauthManager: replace the unguarded `this.oauthConfig.storage!` assertions on
  the EMA re-mint/persist paths with a `requireStorage()` helper that throws a
  clear error; in `getOAuthState` reuse the already-narrowed local `storage`.
- cli: `parseRunnerOAuthCallbackUrl` always returns a config, so make
  `callMethod`'s `callbackUrlConfig` (and the always-passed `cliAuthOverrides`)
  required instead of asserting them non-null at three call sites.
- test-servers/resolve-config: drop the `as unknown as T` double cast; collect
  into a base-shaped array and do a single honest downcast at the return.

No behavior change; validate + coverage green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DZyeWManYTvcXxjcrhxSQc

clients/cli/src/cli.ts

@@ -71,8 +71,8 @@ async function callMethod(
   serverSettings: InspectorServerSettings | undefined,
   args: MethodArgs & { method: string },
   clientConfig: ClientConfig,
-  cliAuthOverrides?: RunnerClientConfigOverrides,
-  callbackUrlConfig?: RunnerOAuthCallbackConfig,
+  cliAuthOverrides: RunnerClientConfigOverrides,
+  callbackUrlConfig: RunnerOAuthCallbackConfig,
 ): Promise<void> {
   const __dirname = dirname(fileURLToPath(import.meta.url));
   const packageJsonPath = join(__dirname, "../package.json");
@@ -93,9 +93,8 @@ async function callMethod(
   };
   const redirectUrlProvider = new MutableRedirectUrlProvider();
   if (isOAuthCapableServerConfig(serverConfig)) {
-    redirectUrlProvider.redirectUrl = formatRunnerOAuthRedirectUrl(
-      callbackUrlConfig!,
-    );
+    redirectUrlProvider.redirectUrl =
+      formatRunnerOAuthRedirectUrl(callbackUrlConfig);
     environment.oauth = {
       storage: new NodeOAuthStorage(),
       navigation: new ConsoleNavigation(),
@@ -258,14 +257,14 @@ async function callMethod(
       inspectorClient,
       serverConfig,
       redirectUrlProvider,
-      callbackUrlConfig!,
+      callbackUrlConfig,
       serverSettings,
     );
 
     const result = await withCliAuthRecoveryRetry(
       inspectorClient,
       redirectUrlProvider,
-      callbackUrlConfig!,
+      callbackUrlConfig,
       serverSettings,
       runMethod,
     );