feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

test-servers/src/resolve-config.ts

@@ -82,5 +82,13 @@ export function resolveConfig(config: ConfigFile): ServerConfig {
     port: isHttp ? transport.port : undefined,
   };
 
+  if (config.oauth) {
+    const { issuerUrl, ...oauthRest } = config.oauth;
+    serverConfig.oauth = {
+      ...oauthRest,
+      ...(issuerUrl && { issuerUrl: new URL(issuerUrl) }),
+    };
+  }
+
   return serverConfig;
 }