fix(auth): make the durability guard provenance-aware, and harden the claim

Round 20, and almost all of it is fallout from round 19's two changes. Both
were right in direction and wrong in the detail, in the same way: each solved
its case by treating a broad thing as a proxy for a narrow one.

**The durability guard wrote newly entered secrets to disk in plaintext.**
Preserving legacy plaintext for a session-scoped store is correct — stripping
it moves the only durable copy into RAM. Using *the whole submitted entry* as
the proxy for "legacy" was not: it turned
`MCP_INSPECTOR_SECRET_STORE=memory` into "write every new secret to
`mcp.json` in the clear", while the footer for that very store says secrets
are written nowhere. A security regression introduced by a data-loss fix, and
the same overshoot in `client.json`.

Provenance decides now. A secret field is kept on disk only when it was
already there, unchanged, in the file being overwritten; a newly entered or
changed value is stripped and lives in the session store, which is exactly
what the footer promises. Where provenance cannot be established — an
unparseable prior file — the value is treated as new, because writing a
secret to disk on a guess is the failure that matters.

**The atomic claim was not as safe as its comments said.** Four ways:

- A crash between the claim and the copy left only
  `secrets.json.migrating-<pid>`. The next run checked the canonical path,
  found nothing, selected the keychain, and every stored credential vanished
  with no warning. Orphans are now adopted at startup.
- Restoring used `rename`, which on POSIX **replaces** its destination — so
  the restore path could overwrite a `secrets.json` a concurrent writer had
  recreated, destroying the later successful write that claiming exists to
  protect. The comment beside it asserted the opposite. `link` + `unlink` is
  the no-clobber primitive this needed.
- Every claim failure was read as a lost race. `EACCES`/`EROFS` leave the
  file exactly where it is, and returning quietly selected the keychain while
  file-backed secrets sat there invisible. Only `ENOENT` is benign now.
- A failed cleanup left a plaintext-capable snapshot on disk with a silent
  catch, while the app reported the keychain as the only store. It names the
  path now.

**A third secret-entry surface had no disclosure at all.** `ServerConfigModal`
takes stdio `env` values, which are extracted into the store exactly as
Server Settings' are — and the footer's own doc comment claimed there were
only two such dialogs. It has the footer now, and every server write that can
carry a secret (config submit, both import flows) refreshes the descriptor,
not just the settings save.

Full `npm run ci` green, staged tree verified first.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/components/groups/ServerConfigModal/ServerConfigModal.test.tsx

@@ -471,3 +471,42 @@ describe("ServerConfigModal", () => {
     expect(props.onClose).toHaveBeenCalledOnce();
   });
 });
+
+describe("secret-storage footer (#1950 review r20)", () => {
+  it("discloses where stdio env values will be kept", () => {
+    // This dialog takes stdio `env` values, which are extracted into the
+    // secret store exactly as Server Settings' are — so it is a secret-entry
+    // surface. It had no disclosure at all, which made it the one place a
+    // user could type a secret without being told where it goes.
+    renderWithMantine(
+      <ServerConfigModal
+        opened
+        mode="add"
+        existingIds={[]}
+        onClose={vi.fn()}
+        onSubmit={vi.fn()}
+        secretStorage={{
+          kind: "memory",
+          reason: "fallback",
+          durable: false,
+        }}
+      />,
+    );
+    expect(screen.getByTestId("secret-storage-footer")).toHaveTextContent(
+      "Secrets: Memory (this session only)",
+    );
+  });
+
+  it("renders no footer when the backend didn't report a store", () => {
+    renderWithMantine(
+      <ServerConfigModal
+        opened
+        mode="add"
+        existingIds={[]}
+        onClose={vi.fn()}
+        onSubmit={vi.fn()}
+      />,
+    );
+    expect(screen.queryByTestId("secret-storage-footer")).toBeNull();
+  });
+});

clients/web/src/components/groups/ServerConfigModal/ServerConfigModal.tsx

@@ -10,6 +10,8 @@ import {
   Textarea,
 } from "@mantine/core";
 import { ClearButton } from "../../elements/ClearButton/ClearButton";
+import { SecretStorageFooter } from "../../elements/SecretStorageFooter/SecretStorageFooter";
+import type { SecretStorageInfo } from "@inspector/core/auth/secret-storage-info.js";
 import { useValueChange } from "../../../hooks/useValueChange";
 import type {
   MCPServerConfig,
@@ -33,6 +35,14 @@ export interface ServerConfigModalProps {
   existingIds: string[];
   onClose: () => void;
   onSubmit: (id: string, config: MCPServerConfig) => Promise<void> | void;
+  /**
+   * Where secrets typed here end up (#1950 review r20). This dialog takes
+   * stdio `env` values, which are extracted into the secret store exactly as
+   * the ones in Server Settings are — so it is a secret-entry surface and
+   * needs the same permanent disclosure. It had none, which meant a user
+   * could type a value into the one dialog that never said where it goes.
+   */
+  secretStorage?: SecretStorageInfo;
 }
 
 type TransportChoice = "stdio" | "sse" | "streamable-http";
@@ -188,6 +198,7 @@ export function ServerConfigModal({
   existingIds,
   onClose,
   onSubmit,
+  secretStorage,
 }: ServerConfigModalProps) {
   const initial = useMemo(
     () => configToFormState(initialId, initialConfig, mode),
@@ -446,6 +457,7 @@ export function ServerConfigModal({
           </Button>
         </Actions>
       </SectionStack>
+      <SecretStorageFooter info={secretStorage} />
     </AppModalLg>
   );
 }