feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/cli/__tests__/metadata.test.ts

@@ -373,16 +373,17 @@ describe("Metadata Tests", () => {
 
         expectCliSuccess(result);
 
-        // Validate metadata values are sent as strings
+        // A JSON-parseable value goes out as that JSON type, not as its
+        // string spelling (#1910) — `_meta` takes any JSON.
         const recordedRequests = server.getRecordedRequests();
         const toolsListRequest = recordedRequests.find(
           (r) => r.method === "tools/list",
         );
         expect(toolsListRequest).toBeDefined();
         expect(toolsListRequest?.metadata).toEqual({
-          integer_value: "42",
-          decimal_value: "3.14159",
-          negative_value: "-10",
+          integer_value: 42,
+          decimal_value: 3.14159,
+          negative_value: -10,
         });
       } finally {
         await server.stop();
@@ -428,7 +429,7 @@ describe("Metadata Tests", () => {
       }
     });
 
-    it("JSON.stringifies object/array metadata (not String → [object Object])", async () => {
+    it("sends object/array/boolean metadata as real JSON, not stringified (#1910)", async () => {
       const server = createTestServerHttp({
         serverInfo: createTestServerInfo(),
         tools: [createEchoTool()],
@@ -456,9 +457,9 @@ describe("Metadata Tests", () => {
           (r) => r.method === "tools/list",
         );
         expect(toolsListRequest?.metadata).toEqual({
-          nested: '{"key":"value"}',
-          list: "[1,2,3]",
-          flag: "true",
+          nested: { key: "value" },
+          list: [1, 2, 3],
+          flag: true,
         });
       } finally {
         await server.stop();
@@ -819,7 +820,7 @@ describe("Metadata Tests", () => {
         );
         expect(toolsListRequest).toBeDefined();
         expect(toolsListRequest?.metadata).toEqual({
-          integration_test: "true",
+          integration_test: true,
           test_phase: "all_methods",
         });
       } finally {
@@ -866,8 +867,8 @@ describe("Metadata Tests", () => {
         );
         expect(toolCallRequest).toBeDefined();
         expect(toolCallRequest?.metadata).toEqual({
-          session_id: "12345",
-          user_id: "67890",
+          session_id: 12345,
+          user_id: 67890,
           timestamp: "2024-01-01T00:00:00Z",
           request_id: "req-abc-123",
           tool_session: "session-xyz-789",
@@ -919,8 +920,8 @@ describe("Metadata Tests", () => {
         expect(toolCallRequest).toBeDefined();
         expect(toolCallRequest?.metadata).toEqual({
           valid_key: "valid_value",
-          numeric_key: "123",
-          boolean_key: "true",
+          numeric_key: 123,
+          boolean_key: true,
           json_key: '\'{"test":"value"}\'', // Single quotes are preserved
           special_key: "!@#$%^&*()",
           unicode_key: "🚀🎉✨",