feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

core/auth/browser/storage.ts

@@ -13,3 +13,13 @@ export class BrowserOAuthStorage extends OAuthStorageBase {
     super(createOAuthStore(createJSONStorage(() => sessionStorage)));
   }
 }
+
+let sharedBrowserOAuthStorage: BrowserOAuthStorage | undefined;
+
+/** Shared sessionStorage-backed OAuth store for the web client (single in-memory view). */
+export function getBrowserOAuthStorage(): BrowserOAuthStorage {
+  if (!sharedBrowserOAuthStorage) {
+    sharedBrowserOAuthStorage = new BrowserOAuthStorage();
+  }
+  return sharedBrowserOAuthStorage;
+}