feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/__tests__/fakeInspectorClient.ts

@@ -36,6 +36,7 @@ import type {
   ResourceSubscriptionStreamState,
   ToolCallInvocation,
   ExcludedTool,
+  RequestMetadata,
 } from "../types.js";
 import { INACTIVE_SUBSCRIPTION_STREAM_STATE } from "../types.js";
 import type { MalformedListItem } from "../listSalvage.js";
@@ -145,25 +146,25 @@ export class FakeInspectorClient
   listAllTools = vi.fn(
     async (_options?: {
       cacheMode?: CacheMode;
-      metadata?: Record<string, string>;
+      metadata?: RequestMetadata;
     }) => ({ tools: drainPages(this.toolPages, "tools") }),
   );
   listAllPrompts = vi.fn(
     async (_options?: {
       cacheMode?: CacheMode;
-      metadata?: Record<string, string>;
+      metadata?: RequestMetadata;
     }) => ({ prompts: drainPages(this.promptPages, "prompts") }),
   );
   listAllResources = vi.fn(
     async (_options?: {
       cacheMode?: CacheMode;
-      metadata?: Record<string, string>;
+      metadata?: RequestMetadata;
     }) => ({ resources: drainPages(this.resourcePages, "resources") }),
   );
   listAllResourceTemplates = vi.fn(
     async (_options?: {
       cacheMode?: CacheMode;
-      metadata?: Record<string, string>;
+      metadata?: RequestMetadata;
     }) => ({
       resourceTemplates: drainPages(
         this.resourceTemplatePages,
@@ -224,7 +225,7 @@ export class FakeInspectorClient
       _argumentName: string,
       _argumentValue: string,
       _context?: Record<string, string>,
-      _metadata?: Record<string, string>,
+      _metadata?: RequestMetadata,
     ): Promise<{ values: string[]; total?: number; hasMore?: boolean }> => ({
       values: [],
     }),