feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

clients/web/src/lib/environmentFactory.ts

@@ -5,7 +5,7 @@ import {
   createRemoteLogger,
 } from "@inspector/core/mcp/remote/index.js";
 import {
-  BrowserOAuthStorage,
+  getBrowserOAuthStorage,
   BrowserNavigation,
 } from "@inspector/core/auth/browser/index.js";
 import type { RedirectUrlProvider } from "@inspector/core/auth/index.js";
@@ -67,7 +67,7 @@ export function createWebEnvironment(
     }),
     logger,
     oauth: {
-      storage: new BrowserOAuthStorage(),
+      storage: getBrowserOAuthStorage(),
       navigation: new BrowserNavigation(undefined, onBeforeOAuthRedirect),
       redirectUrlProvider,
     },