fix: encode per RFC 3986, and derive the TUI form from the shared parser

Addresses Copilot's round-4 review on #2035 — again reported as "no new
comments" while carrying three suppressed ones. All three reproduced.

1. The TUI form still named its fields from the SDK. `uriTemplateToForm`
   read `UriTemplate.variableNames`, which mangles a name: `{;id}` yields
   ";id" and `{id:3}` yields "id:3". The form therefore submitted
   `{ ";id": "7" }` while the shared expander looked up `id`, found
   nothing, and dropped the expression — the value vanished silently.

   This is the finding that mattered most, because it falsified the claim
   this change is built on. Moving the expander into core only makes the
   clients agree if each client's FORM derives its names from the same
   parser: a form submits under the names it rendered. The TUI now reads
   `templateVariables`, and the SDK template is constructed only to
   validate, preserving the existing malformed-template diagnostic.

   Its `required` flag comes from `requiredGroups`, and only a variable
   that is the sole member of a non-omittable expression is marked: ink-
   form cannot express "any one of these", so marking every member of
   `{a,b}` required would refuse input the expander accepts.

2. `encodeURIComponent` is not RFC 3986's unreserved set — it leaves the
   sub-delims !'()* bare, which RFC 6570 requires encoded for every
   operator except + and #.

   Fixing that settled a design question left open in the previous round.
   With two encoders, the SAME value encoded differently depending on
   whether its expression happened to carry a modifier, since only the
   modifier pushed it onto our path. So delegation is gone entirely: one
   expander, one set of rules. The SDK's `UriTemplate` is still
   constructed, but only to validate a template.

3. The "Any one of: a, b" hint could contradict the disabled submit
   button. A name can sit in a singleton required group AND a shared one
   (`x://{a}/{a,b}`), where the singleton demands that exact field. The
   hint is suppressed in that case.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/components/groups/ResourceTemplatePanel/ResourceTemplatePanel.tsx

@@ -253,9 +253,18 @@ export function ResourceTemplatePanel({
           // required multi-name expression no single field is mandatory either
           // -- any one of them satisfies it -- so say which, rather than
           // marking each one required and blocking valid input.
-          const sharedGroup = groups.find(
-            (names) => names.length > 1 && names.includes(varName),
+          // A name can sit in a singleton required group *and* a shared one
+          // (`x://{a}/{a,b}`). The singleton demands this exact field, so the
+          // "any one of" hint would contradict the disabled submit button --
+          // suppress it and let the field read as plainly required.
+          const individuallyRequired = groups.some(
+            (names) => names.length === 1 && names[0] === varName,
           );
+          const sharedGroup = individuallyRequired
+            ? undefined
+            : groups.find(
+                (names) => names.length > 1 && names.includes(varName),
+              );
           const description = !required
             ? "Optional"
             : sharedGroup

clients/web/src/test/core/mcp/uriTemplate.test.ts

@@ -432,3 +432,36 @@ describe("allow-reserved encoding under + and #", () => {
     );
   });
 });
+
+describe("unreserved encoding under the non-reserved operators", () => {
+  // `encodeURIComponent` leaves the sub-delims !'()* bare, but RFC 6570 only
+  // allows *unreserved* characters through for these operators.
+  it.each([
+    ["", "x://"],
+    [".", "x://a."],
+    ["/", "x://a/"],
+  ])("encodes !'()* under the %s operator", (operator, prefix) => {
+    const base = operator === "" ? "x://" : "x://a";
+    expect(
+      expandUriTemplate(`${base}{${operator}v}`, { v: "a!b'c(d)e*f" }),
+    ).toBe(`${prefix}a%21b%27c%28d%29e%2Af`);
+  });
+
+  it("encodes them in a named (query) expression too", () => {
+    expect(expandUriTemplate("x://a{?v}", { v: "a!b" })).toBe("x://a?v=a%21b");
+  });
+
+  it("encodes them in a matrix expression too", () => {
+    expect(expandUriTemplate("x://a{;v}", { v: "a!b" })).toBe("x://a;v=a%21b");
+  });
+
+  it("leaves them alone under + and #, where reserved characters are allowed", () => {
+    expect(expandUriTemplate("x://{+v}", { v: "a!b'c(d)e*f" })).toBe(
+      "x://a!b'c(d)e*f",
+    );
+  });
+
+  it("still leaves the unreserved set itself untouched", () => {
+    expect(expandUriTemplate("x://{v}", { v: "aZ0-._~" })).toBe("x://aZ0-._~");
+  });
+});