Port v1.5 web dev backend (vite-hono-plugin + remote-server bootstrap) (#1321)

* feat(web): port v1.5 dev backend (vite-hono-plugin + sandbox + remote-server bootstrap)

Ports the v1.5 in-process dev backend into v2 so `npm run dev` serves the
Hono remote-server (`/api/*`) alongside the Vite-served browser app. Without
this, the browser-side `createRemoteTransport` had nothing to talk to during
local development.

Adds under `clients/web/server/`:
- vite-hono-plugin.ts (Hono middleware on the Vite dev server; gated to
  `apply: 'serve'` and skipped when `process.env.VITEST` is set so it stays
  inert in vitest/storybook runs)
- sandbox-controller.ts (standalone HTTP server for the MCP Apps sandbox)
- web-server-config.ts (env parsing + initial-config payload + banner;
  `autoOpen` defaults off under VITEST so test runs don't shell out to `open`)
- server.ts (standalone Hono prod server for the future v2 launcher, #1246)
- start-vite-dev-server.ts (in-process Vite starter for the future launcher)
- vite-base-config.ts (shared optimizeDeps exclusions)

Wires `honoMiddlewarePlugin(buildWebServerConfigFromEnv())` into
`vite.config.ts` with `apply: 'serve'`. Adds the `open` dependency and a
DOM lib + `@inspector/core/*` path alias to `tsconfig.node.json` so the
dev-backend files type-check alongside vite.config.ts.

Coverage: web-server-config.ts (100% lines), sandbox-controller.ts (91% lines),
and vite-base-config.ts (100%) all clear the per-file gate. The Vite plugin,
prod server, and dev-server starter are excluded from coverage as runtime
glue exercised by `npm run dev` end-to-end (callers covered separately;
their logic lives in core/mcp/remote/node, which integration tests already
exercise).

Closes #1320.
Unblocks #1244 (Wire App.tsx) — its test plan can now run end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(web/server): address PR review feedback on the dev-backend port

- sandbox-controller: resolve start() with empty values on listen error
  (e.g. EADDRINUSE on a fixed MCP_SANDBOX_PORT) instead of leaving the
  promise pending forever. Without this, the Vite plugin's
  `await sandboxController.start()` could hang the entire dev backend on a
  port collision. Banner now silently omits the sandbox line; getUrl()
  keeps returning null. Adds a regression test exercising the EADDRINUSE
  path against a real socket.
- vite-hono-plugin: listen for `error` and `close` on the incoming request
  stream (in addition to `end`) so an aborted POST/PUT (browser navigates
  mid-upload) doesn't leak the middleware indefinitely.
- vite-hono-plugin: add a `.catch()` to the initial `pump()` kickoff so a
  sync throw before the first `await reader.read()` can't surface as an
  unhandled rejection.
- sandbox_proxy.html: drop the stale CSP comment — v1.5's sandbox HTTP
  server never set CSP either; this PR doesn't regress anything. Replace
  with the actual isolation model (iframe sandbox attribute + origin
  allowlist) so future readers don't assume a CSP header is enforced.
- Hoist `WebServerHandle` to a shared `server/types.ts` so the future
  launcher port (#1246) doesn't need to pick one of two duplicate
  declarations.
- Extract `resolveAutoOpen()` helper out of the triple-nested ternary in
  `buildWebServerConfigFromEnv` for legibility, with the three-way logic
  documented in one place.
- Add an inline comment explaining why
  `webServerConfigToInitialPayload` falls back to streamable-http for
  unknown discriminators (forward-compat with future SDK transports)
  rather than throwing.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

clients/web/server/start-vite-dev-server.ts

@@ -0,0 +1,49 @@
+/**
+ * Start Vite dev server in-process via the Node API. Config is passed into the plugin; no shared state.
+ *
+ * Uses the shared base config so Node-only callers don't need to load
+ * `vite.config.ts` (which Node can't import directly).
+ */
+
+import { join, dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createServer, type InlineConfig } from "vite";
+import react from "@vitejs/plugin-react";
+import type { WebServerConfig } from "./web-server-config.js";
+import { honoMiddlewarePlugin } from "./vite-hono-plugin.js";
+import { getViteBaseConfig } from "./vite-base-config.js";
+import type { WebServerHandle } from "./types.js";
+
+export type { WebServerHandle };
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Start the Vite dev server in-process. Passes config into the plugin. Caller owns SIGINT/SIGTERM.
+ */
+export async function startViteDevServer(
+  config: WebServerConfig,
+): Promise<WebServerHandle> {
+  // Canonicalize so Vite's config hash is stable and matches the deps cache.
+  const root = resolve(join(__dirname, ".."));
+  const baseConfig = getViteBaseConfig();
+  const inlineConfig: InlineConfig = {
+    ...baseConfig,
+    configFile: false,
+    root,
+    server: {
+      port: config.port,
+      host: config.hostname,
+    },
+    plugins: [react(), honoMiddlewarePlugin(config)],
+  };
+  const server = await createServer(inlineConfig);
+
+  await server.listen();
+
+  return {
+    async close(): Promise<void> {
+      await server.close();
+    },
+  };
+}