fix(auth): make the durability guard provenance-aware, and harden the claim

Round 20, and almost all of it is fallout from round 19's two changes. Both
were right in direction and wrong in the detail, in the same way: each solved
its case by treating a broad thing as a proxy for a narrow one.

**The durability guard wrote newly entered secrets to disk in plaintext.**
Preserving legacy plaintext for a session-scoped store is correct — stripping
it moves the only durable copy into RAM. Using *the whole submitted entry* as
the proxy for "legacy" was not: it turned
`MCP_INSPECTOR_SECRET_STORE=memory` into "write every new secret to
`mcp.json` in the clear", while the footer for that very store says secrets
are written nowhere. A security regression introduced by a data-loss fix, and
the same overshoot in `client.json`.

Provenance decides now. A secret field is kept on disk only when it was
already there, unchanged, in the file being overwritten; a newly entered or
changed value is stripped and lives in the session store, which is exactly
what the footer promises. Where provenance cannot be established — an
unparseable prior file — the value is treated as new, because writing a
secret to disk on a guess is the failure that matters.

**The atomic claim was not as safe as its comments said.** Four ways:

- A crash between the claim and the copy left only
  `secrets.json.migrating-<pid>`. The next run checked the canonical path,
  found nothing, selected the keychain, and every stored credential vanished
  with no warning. Orphans are now adopted at startup.
- Restoring used `rename`, which on POSIX **replaces** its destination — so
  the restore path could overwrite a `secrets.json` a concurrent writer had
  recreated, destroying the later successful write that claiming exists to
  protect. The comment beside it asserted the opposite. `link` + `unlink` is
  the no-clobber primitive this needed.
- Every claim failure was read as a lost race. `EACCES`/`EROFS` leave the
  file exactly where it is, and returning quietly selected the keychain while
  file-backed secrets sat there invisible. Only `ENOENT` is benign now.
- A failed cleanup left a plaintext-capable snapshot on disk with a silent
  catch, while the app reported the keychain as the only store. It names the
  path now.

**A third secret-entry surface had no disclosure at all.** `ServerConfigModal`
takes stdio `env` values, which are extracted into the store exactly as
Server Settings' are — and the footer's own doc comment claimed there were
only two such dialogs. It has the footer now, and every server write that can
carry a secret (config submit, both import flows) refreshes the descriptor,
not just the settings save.

Full `npm run ci` green, staged tree verified first.

Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/remote/node/server.ts

@@ -2116,8 +2116,30 @@ export function createRemoteApp(
   const entryForDisk = async (
     built: StoredMCPServer,
     stripped: StoredMCPServer,
-  ): Promise<StoredMCPServer> =>
-    (await secretStoreIsDurable(secretStore)) ? stripped : built;
+    previous?: StoredMCPServer,
+  ): Promise<StoredMCPServer> => {
+    if (await secretStoreIsDurable(secretStore)) return stripped;
+    // Non-durable, and the distinction is the whole of it: **legacy plaintext
+    // that was already on disk** is preserved, because stripping it would
+    // move the only durable copy into RAM. A **newly entered** secret is not,
+    // because the footer promises that a session store writes secrets
+    // nowhere — and the first version of this used the whole submitted entry
+    // as a proxy for provenance, which turned `MCP_INSPECTOR_SECRET_STORE=
+    // memory` into "write every new secret to mcp.json in the clear" while
+    // the UI said the opposite.
+    //
+    // A changed value is new: the old plaintext goes, the new value lives in
+    // the session store, and the footer's promise holds for it.
+    const prior = previous ? extractSecretsFromStored(previous).secrets : {};
+    const submitted = extractSecretsFromStored(built).secrets;
+    const carry: Record<string, string> = {};
+    for (const [field, value] of Object.entries(submitted)) {
+      if (prior[field] === value) carry[field] = value;
+    }
+    return Object.keys(carry).length > 0
+      ? mergeSecretsIntoStored(stripped, carry)
+      : stripped;
+  };
 
   const keychainErrorResponse = (
     c: Context,
@@ -2534,7 +2556,7 @@ export function createRemoteApp(
           }
         }
         const { stripped, secrets } = extractSecretsFromStored(built);
-        const onDisk = await entryForDisk(built, stripped);
+        const onDisk = await entryForDisk(built, stripped, existing);
         const next: MCPConfig = { mcpServers: {} };
         for (const [key, val] of Object.entries(current.mcpServers)) {
           if (key === originalId) {