fix(auth): make the durability guard provenance-aware, and harden the claim

Round 20, and almost all of it is fallout from round 19's two changes. Both
were right in direction and wrong in the detail, in the same way: each solved
its case by treating a broad thing as a proxy for a narrow one.

**The durability guard wrote newly entered secrets to disk in plaintext.**
Preserving legacy plaintext for a session-scoped store is correct — stripping
it moves the only durable copy into RAM. Using *the whole submitted entry* as
the proxy for "legacy" was not: it turned
`MCP_INSPECTOR_SECRET_STORE=memory` into "write every new secret to
`mcp.json` in the clear", while the footer for that very store says secrets
are written nowhere. A security regression introduced by a data-loss fix, and
the same overshoot in `client.json`.

Provenance decides now. A secret field is kept on disk only when it was
already there, unchanged, in the file being overwritten; a newly entered or
changed value is stripped and lives in the session store, which is exactly
what the footer promises. Where provenance cannot be established — an
unparseable prior file — the value is treated as new, because writing a
secret to disk on a guess is the failure that matters.

**The atomic claim was not as safe as its comments said.** Four ways:

- A crash between the claim and the copy left only
  `secrets.json.migrating-<pid>`. The next run checked the canonical path,
  found nothing, selected the keychain, and every stored credential vanished
  with no warning. Orphans are now adopted at startup.
- Restoring used `rename`, which on POSIX **replaces** its destination — so
  the restore path could overwrite a `secrets.json` a concurrent writer had
  recreated, destroying the later successful write that claiming exists to
  protect. The comment beside it asserted the opposite. `link` + `unlink` is
  the no-clobber primitive this needed.
- Every claim failure was read as a lost race. `EACCES`/`EROFS` leave the
  file exactly where it is, and returning quietly selected the keychain while
  file-backed secrets sat there invisible. Only `ENOENT` is benign now.
- A failed cleanup left a plaintext-capable snapshot on disk with a silent
  catch, while the app reported the keychain as the only store. It names the
  path now.

**A third secret-entry surface had no disclosure at all.** `ServerConfigModal`
takes stdio `env` values, which are extracted into the store exactly as
Server Settings' are — and the footer's own doc comment claimed there were
only two such dialogs. It has the footer now, and every server write that can
carry a secret (config submit, both import flows) refreshes the descriptor,
not just the settings save.

Full `npm run ci` green, staged tree verified first.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/client/node-persistence.test.ts

@@ -235,6 +235,22 @@ describe("session-scoped store keeps client.json durable (#1950 review r19)", ()
     const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-durable-"));
     const file = path.join(dir, "client.json");
     try {
+      // Legacy state: the secret is *already* on disk in plaintext, which is
+      // what the durability guard exists to preserve.
+      await fs.writeFile(
+        file,
+        JSON.stringify({
+          enterpriseManagedAuth: {
+            enabled: true,
+            idp: {
+              issuer: "https://idp.example/",
+              clientId: "cid",
+              clientSecret: "must-survive",
+            },
+          },
+        }),
+        "utf-8",
+      );
       await writeClientConfigStore(
         file,
         {
@@ -255,6 +271,79 @@ describe("session-scoped store keeps client.json durable (#1950 review r19)", ()
     }
   });
 
+  it("does not write a newly entered IdP secret to disk on a session store", async () => {
+    // Same overshoot as the server path: preserving *legacy* plaintext is
+    // right, treating every submitted value as legacy is not — it would put a
+    // freshly typed secret in `client.json` while the footer says a session
+    // store writes secrets nowhere.
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-fresh-"));
+    const file = path.join(dir, "client.json");
+    try {
+      await writeClientConfigStore(
+        file,
+        {
+          enterpriseManagedAuth: {
+            enabled: true,
+            idp: {
+              issuer: "https://idp.example/",
+              clientId: "cid",
+              clientSecret: "never-typed-before",
+            },
+          },
+        },
+        new SessionSecretStore(),
+      );
+      expect(await fs.readFile(file, "utf-8")).not.toContain(
+        "never-typed-before",
+      );
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("keeps a new secret off disk when the prior file is unreadable", async () => {
+    // Provenance cannot be established from a file that will not parse, and
+    // the conservative direction is to treat the value as new — writing a
+    // secret to disk on a guess is the failure that matters.
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-bad-"));
+    const file = path.join(dir, "client.json");
+    try {
+      await fs.writeFile(file, "{ not json", "utf-8");
+      await writeClientConfigStore(
+        file,
+        {
+          enterpriseManagedAuth: {
+            enabled: true,
+            idp: {
+              issuer: "https://idp.example/",
+              clientId: "cid",
+              clientSecret: "unprovenanced",
+            },
+          },
+        },
+        new SessionSecretStore(),
+      );
+      expect(await fs.readFile(file, "utf-8")).not.toContain("unprovenanced");
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
+  it("writes nothing extra when a session store has no IdP secret at all", async () => {
+    const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-none-"));
+    const file = path.join(dir, "client.json");
+    try {
+      await writeClientConfigStore(
+        file,
+        { cimd: { enabled: true, clientMetadataUrl: "https://x.test/cimd" } },
+        new SessionSecretStore(),
+      );
+      expect(await fs.readFile(file, "utf-8")).toContain("cimd");
+    } finally {
+      await fs.rm(dir, { recursive: true, force: true });
+    }
+  });
+
   it("still strips against a durable store, so the guard is the difference", async () => {
     const dir = await fs.mkdtemp(path.join(os.tmpdir(), "client-durable-"));
     const file = path.join(dir, "client.json");