feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

test-servers/configs/xaa-ema-http.json

@@ -0,0 +1,22 @@
+{
+  "serverInfo": {
+    "name": "xaa-ema-resource",
+    "version": "1.0.0"
+  },
+  "tools": [{ "preset": "echo" }, { "preset": "get_temp" }],
+  "transport": {
+    "type": "streamable-http",
+    "port": 8080
+  },
+  "oauth": {
+    "enabled": true,
+    "mode": "protected-resource",
+    "authorizationServers": ["https://auth.resource.xaa.dev"],
+    "requireAuth": true,
+    "scopesSupported": ["mcp"],
+    "accessTokenIssuers": ["https://auth.resource.xaa.dev"],
+    "jwksUri": "https://auth.resource.xaa.dev/jwks",
+    "resource": "http://localhost:8080/",
+    "resourceAudience": "http://localhost:8080/"
+  }
+}