fix(web): validate IdP issuer URL inline in Client Settings (#1533) (#1534)

The Enterprise-Managed Authorization "Issuer" field accepted arbitrary
non-URL text and only failed at save time, surfacing a raw Zod issue array
in "Failed to save client settings" toasts.

- Inline field-level validation: the Issuer input shows a friendly error
  ("Must be an http(s) URL, like https://idp.example.com").
- canPersistClientSettingsDraft gates on issuer validity (deferring to
  validateClientSettings) so an invalid value is never sent to the backend.
- Extract isAbsoluteHttpUrl in core/client/config-parse so the Zod schema
  and the form share one http(s)-only URL rule.
- Harden the fallback save-error toast via formatClientConfigLoadError.

Closes #1533

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/components/groups/ClientSettingsForm/clientSettingsValues.ts

@@ -1,4 +1,33 @@
 import type { ClientConfig } from "@inspector/core/client/types.js";
+import { isAbsoluteHttpUrl } from "@inspector/core/client/config-parse.js";
+
+/** Field-level error message for an issuer that is not an http(s) URL. */
+export const ISSUER_URL_ERROR =
+  "Must be an http(s) URL, like https://idp.example.com";
+
+/** Field-level validation errors for the client settings form. */
+export interface ClientSettingsErrors {
+  issuer?: string;
+}
+
+/**
+ * Inline validation for the client settings form. Only flags fields that the
+ * user has actually filled in — empty required fields are gated by
+ * {@link canPersistClientSettingsDraft} rather than surfaced as errors.
+ */
+export function validateClientSettings(
+  values: ClientSettingsFormValues,
+): ClientSettingsErrors {
+  const errors: ClientSettingsErrors = {};
+  if (
+    values.emaEnabled &&
+    values.issuer.trim() !== "" &&
+    !isAbsoluteHttpUrl(values.issuer)
+  ) {
+    errors.issuer = ISSUER_URL_ERROR;
+  }
+  return errors;
+}
 
 /** Form shape for install-level client settings (client.json). */
 export interface ClientSettingsFormValues {
@@ -65,5 +94,10 @@ export function canPersistClientSettingsDraft(
   values: ClientSettingsFormValues,
 ): boolean {
   if (!values.emaEnabled) return true;
-  return values.issuer.trim() !== "" && values.clientId.trim() !== "";
+  if (values.issuer.trim() === "" || values.clientId.trim() === "")
+    return false;
+  // Defer to validateClientSettings so the persist gate and the inline field
+  // errors can never drift: an invalid issuer is never sent to the backend, and
+  // the field error guides the user instead of a raw validation failure toast.
+  return Object.keys(validateClientSettings(values)).length === 0;
 }