fix: key resource list rows by position so duplicate URIs cannot collide

The Resources sidebar keyed every row on its `uri` (and templates on
`uriTemplate`), but nothing in MCP makes those unique — a server may return
the same URI twice, and `ManagedListState.applyItems` replaces the list
wholesale, so a repeat is what the server actually sent. React logged
`Encountered two children with the same key` on every render, and a
filtered-out row survived reconciliation instead of unmounting.

This is the resources counterpart of #1957. The row identity is now the same
`listRowKey(id, sourceIndex)` the Tools sidebar has used since then, extracted
so the two formats cannot drift; `toolRowKey` delegates to it. Applied to all
three Resources lists and to `RootsTable`, whose user-maintained list can
collect a duplicate URI the same way.

Selection stays keyed on the URI, deliberately: unlike a duplicated tool name
(#2001), duplicate rows here denote the same resource — a `resources/read`
takes the URI — so highlighting both is correct. Only the React key needs to
tell them apart.

Adds `ServerConfig.duplicateResourceUris` and the
`duplicate-resource-uris-http.json` showcase config, the `resources/list`
mirror of `duplicateToolNames`, so the defect has a fixture to reproduce it —
appended rather than adjacent, for the reason #1957 documented.

Closes #2206

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018yVgAJz4wpkS4mkGk7DQnp
Signed-off-by: cliffhall <cliff@futurescale.com>

test-servers/src/load-config.ts

@@ -92,6 +92,12 @@ export interface ConfigFile {
    * no preset can produce. See {@link ServerConfig.duplicateToolNames} (#1957).
    */
   duplicateToolNames?: string[];
+  /**
+   * URIs of registered resources to emit **twice** in `resources/list` (same
+   * `uri`, the second's title marked "(duplicate)"). See
+   * {@link ServerConfig.duplicateResourceUris} (#2206).
+   */
+  duplicateResourceUris?: string[];
   /**
    * Replace a registered tool's advertised `inputSchema`/`outputSchema` with a
    * raw JSON Schema document — the constructs a Zod-built preset cannot emit.