feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

clients/web/src/components/groups/ConnectionInfoContent/oauthDetailsFromConnectionState.ts

@@ -0,0 +1,25 @@
+import type { OAuthConnectionState } from "@inspector/core/auth/types.js";
+import type { OAuthDetails } from "./ConnectionInfoContent";
+
+/** Map persisted connection auth state into Connection Info display props. */
+export function oauthDetailsFromConnectionState(
+  state: OAuthConnectionState,
+): OAuthDetails {
+  const scopeSource = state.grantedScope ?? state.configuredScope;
+  const scopes = scopeSource?.split(" ").filter(Boolean);
+
+  return {
+    protocol: state.protocol,
+    authorized: state.authorized,
+    ...(state.client?.clientId && { clientId: state.client.clientId }),
+    ...(state.authorizationServerMetadata?.authorization_endpoint && {
+      authUrl: state.authorizationServerMetadata.authorization_endpoint,
+    }),
+    ...(scopes && scopes.length > 0 && { scopes }),
+    ...(state.tokens?.access_token && {
+      accessToken: state.tokens.access_token,
+    }),
+    ...(state.protocol === "ema" &&
+      state.ema?.idpSession && { idpSession: state.ema.idpSession }),
+  };
+}