refactor(web): consolidate the three GET /api/config hooks into one (#1770)

* refactor(web): consolidate the three GET /api/config hooks into one (#1643)

useSandboxUrl, useServerListWritable, and useInspectorVersion each fetched
the same static /api/config payload separately and read one field from it —
three requests on load for one payload. Replace them with a single
useInitialConfig hook that fetches once and exposes { version, sandboxUrl,
writable, loading } with the same tolerant parsing/defaults (writable
defaults true; version/sandboxUrl undefined when absent; unmount-safe).

- Add core/react/useInitialConfig.ts; wire App.tsx to it.
- Remove the three former single-field hooks and their tests.
- Fold the fetch-branch matrix into one useInitialConfig test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5

* test(web): address review nits on useInitialConfig tests (#1643)

- "keeps writable true for any non-false value" now sends real falsy-but-
  not-false values a nonconforming backend could actually emit (null / 0 /
  "no") instead of `writable: undefined`, which was indistinguishable from an
  absent key and duplicated the omitted-field test.
- Soften the post-unmount comment to say the test exercises the isCancelled()
  guard branches for coverage rather than implying it can detect their removal
  (React 18 dropped the setState-after-unmount warning).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5

* docs(web): fix contradicting unmount-guard comment; it.each writable cases (#1643)

Second-review follow-ups:
- core/react/useInitialConfig.ts: correct the isCancelled() rationale — React
  18 no longer warns on setState-after-unmount; the guard exists to stop a
  stale payload (after unmount or a baseUrl/authToken re-run) overwriting
  current state. The old wording contradicted the corrected test comment.
- useInitialConfig.test.tsx: convert the writable-non-false loop to it.each so
  each value (null / 0 / "no") reports independently.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5

* test(web): use vitest %j specifier in it.each title; tidy hook docblock (#1643)

Third-review follow-ups (both title/comment-only):
- useInitialConfig.test.tsx: `%p` is a Jest specifier vitest doesn't support,
  so all three cases rendered the literal `%p`. Switch to `%j` — titles now
  render null / 0 / "no" distinctly (verified: `writable=null`, `writable=0`,
  `writable="no"`).
- useInitialConfig.ts: extend the class docblock to say a response is dropped
  after unmount OR a re-fetch, matching the corrected inline guard comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XNdjEPKLG637X8YmhDiEk5

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

clients/web/src/App.tsx

@@ -107,9 +107,7 @@ import { useResourceSubscriptions } from "@inspector/core/react/useResourceSubsc
 import { useMessageLog } from "@inspector/core/react/useMessageLog.js";
 import { useFetchRequestLog } from "@inspector/core/react/useFetchRequestLog.js";
 import { useStderrLog } from "@inspector/core/react/useStderrLog.js";
-import { useSandboxUrl } from "@inspector/core/react/useSandboxUrl.js";
-import { useServerListWritable } from "@inspector/core/react/useServerListWritable.js";
-import { useInspectorVersion } from "@inspector/core/react/useInspectorVersion.js";
+import { useInitialConfig } from "@inspector/core/react/useInitialConfig.js";
 import { usePendingClientRequests } from "@inspector/core/react/usePendingClientRequests.js";
 import { InspectorView } from "./components/views/InspectorView/InspectorView";
 import type {
@@ -697,19 +695,16 @@ function App() {
   const appRendererRef = useRef<AppRendererHandle>(null);
   const configBaseUrl =
     typeof window !== "undefined" ? window.location.origin : "http://localhost";
-  const { sandboxUrl } = useSandboxUrl({
-    baseUrl: configBaseUrl,
-    authToken: getAuthToken(),
-  });
-  // Read-only sessions (launched with `--config` or an ad-hoc server) hide
-  // catalog CRUD; the default catalog and `--catalog` stay writable.
-  const { writable: serverListWritable } = useServerListWritable({
-    baseUrl: configBaseUrl,
-    authToken: getAuthToken(),
-  });
-  // The Inspector version (root package.json), shown in the lower-right corner.
-  // The browser can't read it off disk, so the backend sends it via /api/config.
-  const { version: inspectorVersion } = useInspectorVersion({
+  // One `GET /api/config` fetch recovers every static payload field the app
+  // reads: the MCP Apps `sandboxUrl`, the session's `writable` flag (read-only
+  // `--config` / ad-hoc sessions hide catalog CRUD; the default catalog and
+  // `--catalog` stay writable), and the Inspector `version` shown in the
+  // lower-right corner (the browser can't read it off disk).
+  const {
+    sandboxUrl,
+    writable: serverListWritable,
+    version: inspectorVersion,
+  } = useInitialConfig({
     baseUrl: configBaseUrl,
     authToken: getAuthToken(),
   });