chore(web): move App.tsx's module-level block into files (#2127)

Phase 0 of #2126. Lines 239-668 of clients/web/src/App.tsx were already at
module scope — helpers, formatters, constants, and the toast subcomponents,
none of which close over component state — so the whole block moves verbatim
into files. App.tsx drops from 5,303 to 4,892 lines with no behavior change.

Placement follows the lib-vs-utils rule in AGENTS.md: pure computation to
utils/, anything touching the environment to lib/.

EMPTY_SETTINGS and the two loose toast ids deliberately do NOT land in a new
top-level src/constants.ts, which the issue suggested: the web coverage
include is a whitelist naming components/hooks/theme/lib/utils/server, so a
module there would have fallen out of the >=90 gate silently. They go under
utils/ instead.

ReAuthBannerBar is in the block but not in the issue's table — it was added
after the issue was written (#2108). It moves to components/groups/ReAuthBanner/,
beside the banner it wraps.

Every new module is at 100% on all four coverage dimensions. Two v8 ignores,
each justified in place: getAuthToken's typeof-window guard (a happy-dom
inherent path) and replayProtocolRequest's provably-dead default case.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/utils/stepUp.test.ts

@@ -0,0 +1,45 @@
+import { describe, expect, it } from "vitest";
+import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
+import type { ServerEntry } from "@inspector/core/mcp/types.js";
+import { isEmaStepUp, isStepUpConfirmation } from "./stepUp";
+
+const challenge = (
+  reason: AuthChallenge["reason"] = "insufficient_scope",
+): AuthChallenge => ({ reason });
+
+// Only `settings.enterpriseManaged` is read, so the rest of a ServerEntry is
+// irrelevant here — build the narrow shape the adapters project from.
+const server = (enterpriseManaged?: boolean): ServerEntry =>
+  ({ settings: { enterpriseManaged } }) as ServerEntry;
+
+describe("isEmaStepUp", () => {
+  it("is true for insufficient_scope on an enterprise-managed server", () => {
+    expect(isEmaStepUp(challenge(), server(true))).toBe(true);
+  });
+
+  it("is false when the server is not enterprise-managed", () => {
+    expect(isEmaStepUp(challenge(), server(false))).toBe(false);
+  });
+
+  it("is false when there is no server at all", () => {
+    expect(isEmaStepUp(challenge(), undefined)).toBe(false);
+  });
+
+  it("is false for a challenge that is not a scope step-up", () => {
+    expect(isEmaStepUp(challenge("unauthorized"), server(true))).toBe(false);
+  });
+});
+
+describe("isStepUpConfirmation", () => {
+  it("covers both the standard and the enterprise-managed step-up", () => {
+    expect(isStepUpConfirmation(challenge(), server(true))).toBe(true);
+    expect(isStepUpConfirmation(challenge(), server(false))).toBe(true);
+    expect(isStepUpConfirmation(challenge(), undefined)).toBe(true);
+  });
+
+  it("is false for a challenge that is not a scope step-up", () => {
+    expect(isStepUpConfirmation(challenge("unauthorized"), server(true))).toBe(
+      false,
+    );
+  });
+});