fix(auth): make the durability guard provenance-aware, and harden the claim

Round 20, and almost all of it is fallout from round 19's two changes. Both
were right in direction and wrong in the detail, in the same way: each solved
its case by treating a broad thing as a proxy for a narrow one.

**The durability guard wrote newly entered secrets to disk in plaintext.**
Preserving legacy plaintext for a session-scoped store is correct — stripping
it moves the only durable copy into RAM. Using *the whole submitted entry* as
the proxy for "legacy" was not: it turned
`MCP_INSPECTOR_SECRET_STORE=memory` into "write every new secret to
`mcp.json` in the clear", while the footer for that very store says secrets
are written nowhere. A security regression introduced by a data-loss fix, and
the same overshoot in `client.json`.

Provenance decides now. A secret field is kept on disk only when it was
already there, unchanged, in the file being overwritten; a newly entered or
changed value is stripped and lives in the session store, which is exactly
what the footer promises. Where provenance cannot be established — an
unparseable prior file — the value is treated as new, because writing a
secret to disk on a guess is the failure that matters.

**The atomic claim was not as safe as its comments said.** Four ways:

- A crash between the claim and the copy left only
  `secrets.json.migrating-<pid>`. The next run checked the canonical path,
  found nothing, selected the keychain, and every stored credential vanished
  with no warning. Orphans are now adopted at startup.
- Restoring used `rename`, which on POSIX **replaces** its destination — so
  the restore path could overwrite a `secrets.json` a concurrent writer had
  recreated, destroying the later successful write that claiming exists to
  protect. The comment beside it asserted the opposite. `link` + `unlink` is
  the no-clobber primitive this needed.
- Every claim failure was read as a lost race. `EACCES`/`EROFS` leave the
  file exactly where it is, and returning quietly selected the keychain while
  file-backed secrets sat there invisible. Only `ENOENT` is benign now.
- A failed cleanup left a plaintext-capable snapshot on disk with a silent
  catch, while the app reported the keychain as the only store. It names the
  path now.

**A third secret-entry surface had no disclosure at all.** `ServerConfigModal`
takes stdio `env` values, which are extracted into the store exactly as
Server Settings' are — and the footer's own doc comment claimed there were
only two such dialogs. It has the footer now, and every server write that can
carry a secret (config submit, both import flows) refreshes the descriptor,
not just the settings save.

Full `npm run ci` green, staged tree verified first.

Signed-off-by: cliffhall <cliff@futurescale.com>

core/client/node-persistence.ts

@@ -131,10 +131,54 @@ export async function writeClientConfigStore(
   const durable = await secretStoreIsDurable(secretStore);
   await writeStoreFile(
     filePath,
-    serializeStore(durable ? stripped : validated),
+    serializeStore(
+      durable
+        ? stripped
+        : await preserveLegacyPlaintext(
+            filePath,
+            validated,
+            stripped,
+            idpSecret,
+          ),
+    ),
   );
 }
 
+/**
+ * For a session-scoped store: keep the IdP secret on disk only when it was
+ * **already there, unchanged**.
+ *
+ * Stripping legacy plaintext would move the only durable copy into RAM (the
+ * read-path migration withholds its strip for exactly this reason, and the
+ * write path has to agree). But writing a *newly entered* secret to disk
+ * would contradict the footer, which promises a session store writes secrets
+ * nowhere — so provenance decides, not the presence of a value in the
+ * submitted body.
+ */
+async function preserveLegacyPlaintext(
+  filePath: string,
+  validated: ClientConfig,
+  stripped: ClientConfig,
+  idpSecret: string | undefined,
+): Promise<ClientConfig> {
+  if (!idpSecret) return stripped;
+  try {
+    const raw = await readStoreFile(filePath);
+    if (raw === null) return stripped;
+    const prior = parseClientConfig(parseStore(raw));
+    const priorSecret =
+      extractSecretsFromClientConfig(prior).secrets[
+        SECRET_FIELD_IDP_CLIENT_SECRET
+      ];
+    return priorSecret === idpSecret ? validated : stripped;
+  } catch {
+    // Unreadable or unparseable prior file: treat the value as new, which is
+    // the conservative direction — it keeps the secret off disk rather than
+    // writing it there on a guess.
+    return stripped;
+  }
+}
+
 /** Remove client.json and the install-level IdP secret from the keychain. */
 export async function deleteClientConfigStore(
   filePath: string,