chore(web): silence benign config-load dep warnings in npm run dev (#1408)

* chore(web): silence benign config-load dep warnings in `npm run dev`

`vite dev` printed three UNRESOLVED_IMPORT warnings at startup (chokidar,
atomically, @napi-rs/keyring). They originate from Vite's config bundler
(Rolldown): the Hono plugin statically imports the node-only dev backend
(core/mcp/remote/node/server.ts), so loading vite.config.ts bundles it and
Rolldown walks its node-only deps. Those deps are correctly externalized — the
browser never loads them and Node resolves them at runtime — so the warnings are
pure noise.

They can't be filtered the usual ways: the static import is required (the
monorepo has no node_modules under core/, so the aliases must resolve the deps
at bundle time — ssrLoadModule / `--configLoader runner` both fail to resolve
them), and the warnings are written directly to the process streams during
config load, bypassing customLogger, logLevel, and rollupOptions.onwarn.

Fix: a tiny `--import` hook (server/quiet-config-warnings.mjs) that drops only
those specific benign warning writes, wired into the `dev` script. Scoped to
`npm run dev` — build, tests, and prod are untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(web): harden dev warning filter per review

- Tighten BENIGN_PAIRS to repo-relative path fragments (not basenames) so an
  unrelated future UNRESOLVED_IMPORT warning mentioning the same dep + a
  same-named file isn't silently dropped. Verified Rolldown prints the full
  repo-relative path. (review #1)
- Add a note that the matcher tracks Rolldown's message format and degrades to a
  safe no-op (warnings return) if that format changes. (review #2)
- Export isBenignWarning/BENIGN_PAIRS, guard the stream patching behind
  !VITEST, add a .d.mts so the pure helper is importable from TS, and add a unit
  test locking the signature pairs and the over-match guards. (review #3)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

AGENTS.md

@@ -16,7 +16,9 @@ inspector/
 │   │   │                               #   web-server-config.ts (env parsing + initial-config payload + banner),
 │   │   │                               #   sandbox-controller.ts (MCP Apps sandbox HTTP server),
 │   │   │                               #   inject-auth-token.ts (embeds the API token into served index.html),
-│   │   │                               #   vite-base-config.ts (shared optimizeDeps exclusions)
+│   │   │                               #   vite-base-config.ts (shared optimizeDeps exclusions),
+│   │   │                               #   quiet-config-warnings.mjs (--import hook for `npm run dev`: drops benign
+│   │   │                               #     node-only UNRESOLVED_IMPORT warnings Rolldown prints at config load)
 │   │   └── static/                     # sandbox_proxy.html (served by sandbox-controller for MCP Apps tab)
 │   ├── cli/                            # CLI client
 │   ├── tui/                            # TUI client