feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/remote/node/server.ts

@@ -41,6 +41,7 @@ import {
 } from "../../types.js";
 import type {
   InspectorServerSettings,
+  RequestMetadata,
   MCPConfig,
   MCPServerConfig,
   StdioServerConfig,
@@ -1212,6 +1213,11 @@ export function createRemoteApp(
   // credentials are intentionally lost on first read (hard cutover per
   // #1358 decision 4). Users re-enter via the form or hand-edit into the
   // flat shape.
+  // A plain JSON object — the container `_meta` requires. Values are
+  // deliberately unchecked: `_meta` takes arbitrary JSON (#1910), and anything
+  // that survived `JSON.parse` already is.
+  const isJsonObject = (v: unknown): v is RequestMetadata =>
+    v !== null && typeof v === "object" && !Array.isArray(v);
   const isStringRecord = (v: unknown): v is Record<string, string> => {
     if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
     for (const val of Object.values(v as Record<string, unknown>)) {
@@ -1324,10 +1330,18 @@ export function createRemoteApp(
         );
         delete valObj.headers;
       }
-      if ("metadata" in valObj && !isKvArray(valObj.metadata)) {
+      // A JSON object post-#1910; the pre-#1910 `{ key, value }[]` pair array
+      // is still accepted so an existing file keeps working (it is normalized
+      // by `normalizeStoredMetadata` on the way into the settings shape, and
+      // rewritten as an object on the next save).
+      if (
+        "metadata" in valObj &&
+        !isJsonObject(valObj.metadata) &&
+        !isKvArray(valObj.metadata)
+      ) {
         logWarn(
           { route: "/api/servers", id, droppedKey: "metadata" },
-          "Dropping malformed `metadata` field — expected `Array<{ key: string, value: string }>`.",
+          "Dropping malformed `metadata` field — expected a JSON object.",
         );
         delete valObj.metadata;
       }
@@ -1556,10 +1570,14 @@ export function createRemoteApp(
         error: "settings.headers must be an array of { key, value }",
       };
     }
-    if (!isKvArray(obj.metadata)) {
+    // `_meta` takes any JSON, so metadata crosses the wire as a plain JSON
+    // object rather than the `{ key, value }` rows headers/env still use
+    // (#1910). Only the container is checked — the values are arbitrary JSON
+    // by design, and anything that survived `c.req.json()` already is.
+    if (!isJsonObject(obj.metadata)) {
       return {
         ok: false,
-        error: "settings.metadata must be an array of { key, value }",
+        error: "settings.metadata must be a JSON object",
       };
     }
     // env is optional on the wire (older clients / non-stdio servers won't send
@@ -1735,7 +1753,7 @@ export function createRemoteApp(
       // Absent → empty list, matching the read side. The write-through drops
       // empty-key rows and clears `config.env` when the list is empty.
       env: isKvArray(obj.env) ? obj.env : [],
-      metadata: obj.metadata as { key: string; value: string }[],
+      metadata: obj.metadata as RequestMetadata,
       connectionTimeout: obj.connectionTimeout as number,
       requestTimeout: obj.requestTimeout as number,
       // Absent → product default, matching the read side