feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

clients/web/src/components/groups/ConnectionInfoModal/ConnectionInfoModal.stories.tsx

@@ -77,6 +77,8 @@ export const WithOAuth: Story = {
     clientCapabilities,
     transport: "streamable-http",
     oauth: {
+      protocol: "standard",
+      authorized: true,
       authUrl: "https://auth.example.com/oauth2/authorize",
       scopes: ["read", "write"],
       accessToken: "eyJhbGciOiJSUzI1NiIs...truncated",