feat: allow complex JSON values in request _meta

Closes #1910

`_meta` was typed `Record<string, string>` end to end in the Inspector —
on disk as a `{ key, value }[]` pair array, in the Server Settings form as
key/value rows, and in every request verb's per-call metadata parameter.
Nothing in the MCP spec restricts a `_meta` value to a string, and the SDK
models the field as a `z.looseObject`, so the restriction was ours alone.

Widen the whole path to `RequestMetadata` (`Record<string, JsonValue>`):

- Per-server default metadata is a JSON **object** on disk and in memory.
  The pre-#1910 pair array is still read (`normalizeStoredMetadata`) so an
  existing `mcp.json` keeps working; it is never written back, so a save
  migrates the entry.
- The Server Settings → Request Metadata section is a JSON editor
  (`JsonObjectInput`) instead of key/value rows — rows cannot express an
  object value. It keeps the typed text as the display source and emits
  only parsed JSON, the same draft split `SchemaJsonField` uses, so the box
  stays typeable; invalid text is flagged inline and not applied.
- The CLI stops flattening `--metadata` / `--tool-metadata` through
  `metaValueToString`. Those values were already JSON-parsed, so
  `trace={"id":"abc"}` used to reach the wire as the *string* `{"id":"abc"}`
  and now reaches it as an object.
- `servers/show` redaction replaces a sensitive key's whole value rather
  than a string, so a structured value cannot leak through its members.
- `progressTokenOf` narrows the reserved `progressToken` key back to
  `string | number` before it reaches the SDK; any other JSON still travels
  inside `_meta` but wires up no progress callback.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/mcp/state/managedListState.ts

@@ -19,6 +19,7 @@ import type {
 } from "@modelcontextprotocol/client";
 import { isClientDecodeRejection } from "../listSalvage.js";
 import { isTerminalStatus } from "../types.js";
+import type { RequestMetadata } from "../types.js";
 import { TypedEventTarget } from "../typedEventTarget.js";
 
 /**
@@ -67,7 +68,7 @@ export interface ManagedListConfig<T, M extends ManagedListEventMap> {
   fetchAll: (
     client: InspectorClientProtocol,
     cacheMode: CacheMode | undefined,
-    metadata: Record<string, string> | undefined,
+    metadata: RequestMetadata | undefined,
   ) => Promise<T[]>;
   /**
    * Whether this list drives a list-changed indicator. When true, a
@@ -97,7 +98,7 @@ export abstract class ManagedListState<
   protected items: T[] = [];
   protected client: InspectorClientProtocol | null = null;
   private unsubscribe: (() => void) | null = null;
-  private _metadata: Record<string, string> | undefined = undefined;
+  private _metadata: RequestMetadata | undefined = undefined;
   private listChanged = false;
   // The last fetch's failure, kept as observable state so a load that fails
   // (a transport error, or a result the SDK codec rejects as invalid) is
@@ -282,7 +283,7 @@ export abstract class ManagedListState<
     this.emit("errorChange", value);
   }
 
-  setMetadata(metadata?: Record<string, string>): void {
+  setMetadata(metadata?: RequestMetadata): void {
     this._metadata = metadata;
   }
 
@@ -299,7 +300,7 @@ export abstract class ManagedListState<
    * the `list_changed` auto-refresh) catch it explicitly (#1953).
    */
   async refresh(
-    metadata?: Record<string, string>,
+    metadata?: RequestMetadata,
     cacheMode?: CacheMode,
   ): Promise<T[]> {
     let next: T[] | null;
@@ -336,7 +337,7 @@ export abstract class ManagedListState<
    * the console; empty list is the right semantics).
    */
   private async fetchItems(
-    metadata: Record<string, string> | undefined,
+    metadata: RequestMetadata | undefined,
     cacheMode: CacheMode | undefined,
   ): Promise<T[] | null> {
     const client = this.client;

core/mcp/state/pagedPromptsState.ts

@@ -15,6 +15,7 @@
 import type { InspectorClientProtocol } from "../inspectorClientProtocol.js";
 import type { Prompt } from "@modelcontextprotocol/client";
 import { isTerminalStatus } from "../types.js";
+import type { RequestMetadata } from "../types.js";
 import { TypedEventTarget } from "../typedEventTarget.js";
 import type { PagePaginationState } from "./pagedToolsState.js";
 
@@ -112,7 +113,7 @@ export class PagedPromptsState extends TypedEventTarget<PagedPromptsStateEventMa
 
   async loadPage(
     cursor?: string,
-    metadata?: Record<string, string>,
+    metadata?: RequestMetadata,
   ): Promise<LoadPageResult> {
     const c = this.client;
     if (!c || c.getStatus() !== "connected") {

core/mcp/state/pagedResourceTemplatesState.ts

@@ -14,6 +14,7 @@
 import type { InspectorClientProtocol } from "../inspectorClientProtocol.js";
 import type { ResourceTemplateType as ResourceTemplate } from "@modelcontextprotocol/client";
 import { isTerminalStatus } from "../types.js";
+import type { RequestMetadata } from "../types.js";
 import { TypedEventTarget } from "../typedEventTarget.js";
 
 export interface PagedResourceTemplatesStateEventMap {
@@ -59,7 +60,7 @@ export class PagedResourceTemplatesState extends TypedEventTarget<PagedResourceT
 
   async loadPage(
     cursor?: string,
-    metadata?: Record<string, string>,
+    metadata?: RequestMetadata,
   ): Promise<LoadPageResult> {
     const c = this.client;
     if (!c || c.getStatus() !== "connected") {

core/mcp/state/pagedResourcesState.ts

@@ -16,6 +16,7 @@
 import type { InspectorClientProtocol } from "../inspectorClientProtocol.js";
 import type { Resource } from "@modelcontextprotocol/client";
 import { isTerminalStatus } from "../types.js";
+import type { RequestMetadata } from "../types.js";
 import { TypedEventTarget } from "../typedEventTarget.js";
 import type { PagePaginationState } from "./pagedToolsState.js";
 
@@ -113,7 +114,7 @@ export class PagedResourcesState extends TypedEventTarget<PagedResourcesStateEve
 
   async loadPage(
     cursor?: string,
-    metadata?: Record<string, string>,
+    metadata?: RequestMetadata,
   ): Promise<LoadPageResult> {
     const c = this.client;
     if (!c || c.getStatus() !== "connected") {