feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

core/auth/ema/clientConfigError.ts

@@ -0,0 +1,35 @@
+export type EmaClientNotConfiguredReason = "disabled" | "not_configured";
+
+export function emaClientNotConfiguredMessage(
+  reason: EmaClientNotConfiguredReason,
+): string {
+  if (reason === "disabled") {
+    return (
+      "This server uses enterprise-managed authorization, but Enterprise IdP is " +
+      "turned off in Client Settings. Open Client Settings, enable " +
+      '"Enterprise IdP configuration", then try connecting again.'
+    );
+  }
+  return (
+    "This server uses enterprise-managed authorization, but the Inspector " +
+    "client IdP is not configured. Open Client Settings, enable Enterprise IdP, " +
+    "and set issuer, client ID, and client secret."
+  );
+}
+
+/** Thrown when connecting to an EMA server without active install-level IdP config. */
+export class EmaClientNotConfiguredError extends Error {
+  readonly reason: EmaClientNotConfiguredReason;
+
+  constructor(reason: EmaClientNotConfiguredReason) {
+    super(emaClientNotConfiguredMessage(reason));
+    this.name = "EmaClientNotConfiguredError";
+    this.reason = reason;
+  }
+}
+
+export function isEmaClientNotConfiguredError(
+  err: unknown,
+): err is EmaClientNotConfiguredError {
+  return err instanceof EmaClientNotConfiguredError;
+}