refactor: remove unsafe non-null assertions / double-cast in auth paths

Address the TypeScript-safety review items on the mid-session auth work:

- oauthManager: replace the unguarded `this.oauthConfig.storage!` assertions on
  the EMA re-mint/persist paths with a `requireStorage()` helper that throws a
  clear error; in `getOAuthState` reuse the already-narrowed local `storage`.
- cli: `parseRunnerOAuthCallbackUrl` always returns a config, so make
  `callMethod`'s `callbackUrlConfig` (and the always-passed `cliAuthOverrides`)
  required instead of asserting them non-null at three call sites.
- test-servers/resolve-config: drop the `as unknown as T` double cast; collect
  into a base-shaped array and do a single honest downcast at the return.

No behavior change; validate + coverage green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DZyeWManYTvcXxjcrhxSQc

test-servers/src/resolve-config.ts

@@ -29,7 +29,7 @@ function resolvePresetRefs<T extends { requiredScopes?: string[] }>(
   type: "tool" | "resource" | "resourceTemplate" | "prompt",
 ): T[] {
   if (!refs || refs.length === 0) return [];
-  const result: T[] = [];
+  const result: Array<{ requiredScopes?: string[] }> = [];
   for (const entry of refs) {
     const items = Array.isArray(entry) ? entry : [entry];
     for (const ref of items) {
@@ -42,11 +42,13 @@ function resolvePresetRefs<T extends { requiredScopes?: string[] }>(
       const resolved = resolvePreset(type, presetName, ref.params);
       const arr = Array.isArray(resolved) ? resolved : [resolved];
       for (const item of arr) {
-        result.push(mergeRequiredScopes(item as unknown as T, ref));
+        result.push(mergeRequiredScopes(item, ref));
       }
     }
   }
-  return result;
+  // The caller pairs `type` with the matching `T`, so each resolved preset is
+  // the requested definition kind; TS can't see that correspondence.
+  return result as T[];
 }
 
 /**