feat(web,core): enterprise-managed authorization (EMA) (#1509) (#1512)

Adds enterprise-managed authorization (EMA): browser-side IdP login + RFC 8693 token-exchange and JWT-bearer resource-token mint, per-server EMA opt-in in Server Settings, IdP config in Client Settings, and IdP clientSecret keychain storage. Includes the v2/main merge and review follow-ups (400 on malformed client config; normalizeIdpIssuer import consolidation).

test-servers/src/test-server-fixtures.ts

@@ -1922,6 +1922,7 @@ export function createOAuthTestServerConfig(options: {
   return {
     oauth: {
       enabled: true,
+      mode: "combined",
       requireAuth: options.requireAuth ?? false,
       scopesSupported: options.scopesSupported ?? ["mcp"],
       staticClients: options.staticClients,
@@ -1932,3 +1933,31 @@ export function createOAuthTestServerConfig(options: {
     },
   };
 }
+
+/**
+ * MCP resource server that delegates authorization to an external AS (EMA / XAA testing).
+ * Access tokens must be JWTs from that AS (signature + iss validated via JWKS).
+ */
+export function createExternalResourceOAuthTestServerConfig(options: {
+  authorizationServers: string[];
+  requireAuth?: boolean;
+  scopesSupported?: string[];
+  resource?: string;
+  accessTokenIssuers?: string[];
+  jwksUri?: string;
+  resourceAudience?: string;
+}): Partial<ServerConfig> {
+  return {
+    oauth: {
+      enabled: true,
+      mode: "protected-resource",
+      authorizationServers: options.authorizationServers,
+      requireAuth: options.requireAuth ?? true,
+      scopesSupported: options.scopesSupported ?? ["mcp"],
+      resource: options.resource,
+      accessTokenIssuers: options.accessTokenIssuers,
+      jwksUri: options.jwksUri,
+      resourceAudience: options.resourceAudience,
+    },
+  };
+}