fix: preserve CIMD registration provenance across SDK issuer binding (#2242)

`BaseOAuthClientProvider.saveClientInformation` treated every save without an
explicit `registrationKind` as DCR. The SDK reaches it from three places in
`auth()` and only one is a dynamic registration, so the issuer-binding write
overwrote the `cimd` provenance our own pre-registration had just stored — and
Connection Info reported `Dynamic (DCR)` for a connection that never issued a
`POST /oauth/register`.

Recover the kind instead: a `client_id` equal to the configured
`clientMetadataUrl` is CIMD (which also covers the SDK's own CIMD write), and
otherwise a stored registration with the same `client_id` carries its recorded
kind forward. Matching on `client_id` keeps stale CIMD provenance from leaking
onto a later DCR registration for the same server.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Lmj6X2epWpPE7ScdSKQmtA
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/integration/mcp/inspectorClient-oauth-e2e.test.ts

@@ -370,6 +370,15 @@ describe("InspectorClient OAuth E2E", () => {
 
         // Connection should now be successful
         expect(client.getStatus()).toBe("connected");
+
+        // #2242: the metadata-document URL is the client_id, and the stored
+        // provenance still says CIMD after the SDK bound the registration to
+        // the issuer — no `POST /register` ever happened.
+        const oauthState = await client.getOAuthState();
+        expect(oauthState?.client).toMatchObject({
+          clientId: metadataUrl,
+          registrationKind: "cimd",
+        });
       });
 
       it("should retry original request after OAuth completion with CIMD", async () => {