chore(web): move App.tsx's module-level block into files (#2127)

Phase 0 of #2126. Lines 239-668 of clients/web/src/App.tsx were already at
module scope — helpers, formatters, constants, and the toast subcomponents,
none of which close over component state — so the whole block moves verbatim
into files. App.tsx drops from 5,303 to 4,892 lines with no behavior change.

Placement follows the lib-vs-utils rule in AGENTS.md: pure computation to
utils/, anything touching the environment to lib/.

EMPTY_SETTINGS and the two loose toast ids deliberately do NOT land in a new
top-level src/constants.ts, which the issue suggested: the web coverage
include is a whitelist naming components/hooks/theme/lib/utils/server, so a
module there would have fallen out of the >=90 gate silently. They go under
utils/ instead.

ReAuthBannerBar is in the block but not in the issue's table — it was added
after the issue was written (#2108). It moves to components/groups/ReAuthBanner/,
beside the banner it wraps.

Every new module is at 100% on all four coverage dimensions. Two v8 ignores,
each justified in place: getAuthToken's typeof-window guard (a happy-dom
inherent path) and replayProtocolRequest's provably-dead default case.

Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/utils/stepUp.ts

@@ -0,0 +1,31 @@
+import type { AuthChallenge } from "@inspector/core/auth/challenge.js";
+import {
+  isEmaStepUp as isCoreEmaStepUp,
+  isStepUpConfirmation as isCoreStepUpConfirmation,
+} from "@inspector/core/auth/oauthUx.js";
+import type { ServerEntry } from "@inspector/core/mcp/types.js";
+
+// Thin adapters over core's step-up predicates: the web client holds a
+// `ServerEntry` where core takes only the enterprise-managed settings, so these
+// project one onto the other at the single place App.tsx asks the question.
+
+export function isEmaStepUp(
+  challenge: AuthChallenge,
+  server: ServerEntry | undefined,
+): boolean {
+  return isCoreEmaStepUp(challenge, {
+    enterpriseManaged: server?.settings?.enterpriseManaged,
+  });
+}
+
+export function isStepUpConfirmation(
+  challenge: AuthChallenge,
+  server: ServerEntry | undefined,
+): boolean {
+  return isCoreStepUpConfirmation(challenge, {
+    enterpriseManaged: server?.settings?.enterpriseManaged,
+  });
+}
+
+/** Which in-flight action opened the step-up modal (for scoped cancel UX). */
+export type StepUpSource = "tool" | "prompt" | "resource" | "ambient" | "app";