feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

clients/web/src/components/groups/ServerSettingsModal/ServerSettingsModal.stories.tsx

@@ -53,6 +53,7 @@ const meta: Meta<typeof ServerSettingsModal> = {
   render: InteractiveRender,
   args: {
     opened: true,
+    serverType: "streamable-http",
     isStdio: false,
     onClose: fn(),
     onSettingsChange: fn(),
@@ -87,6 +88,7 @@ export const EmptySettings: Story = {
 // Environment Variables section.
 export const StdioServer: Story = {
   args: {
+    serverType: "stdio",
     isStdio: true,
     settings: {
       headers: [],