feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

core/auth/node/oauth-callback-server.ts

@@ -52,7 +52,7 @@ export interface OAuthCallbackServerStartResult {
 
 /**
  * Minimal HTTP server that receives OAuth 2.1 redirects at GET /oauth/callback.
- * Used by TUI/CLI to complete the authorization code flow (both normal and guided).
+ * Used by TUI/CLI to complete the authorization code flow (both quick and guided).
  * Caller provides onCallback/onError; typically onCallback calls
  * InspectorClient.completeOAuthFlow(code) then stops the server.
  */

core/auth/node/secret-store.ts

@@ -22,6 +22,7 @@ const SERVICE_NAME = "mcp-inspector";
 
 export {
   SECRET_FIELD_OAUTH_CLIENT_SECRET,
+  SECRET_FIELD_IDP_CLIENT_SECRET,
   envSecretField,
 } from "../secret-fields.js";