feat(web): migrate OAuth store to shared /store API (RemoteOAuthStorage parity) (closes #1548)

Migrate the web client's OAuth storage from BrowserOAuthStorage
(sessionStorage) to RemoteOAuthStorage, which POSTs through the backend's
/api/storage/oauth route to ~/.mcp-inspector/storage/oauth.json (mode 0600).
A credential obtained in the browser is now the same blob the TUI/CLI read
on the same host, giving web ⇄ TUI ⇄ CLI parity (Wave 1 of #1579).

Core (shared with TUI/CLI):
- OAuthStorageBase now drives a single async hydration (`ready()`,
  `getHydrationError()`); every post-redirect read (getClientInformation,
  getTokens, getCodeVerifier, getServerMetadata, getIdpSession) and every
  save awaits it so a late hydration merge cannot clobber a fresh write.
  getCodeVerifier/getServerMetadata become async; the store is created with
  skipHydration:true so there is no auto-hydration to race the explicit one.
- store.ts adds normalizeServerUrl so a token saved under
  https://Example.com/mcp is found when the CLI asks for
  https://example.com/mcp/; getServerState falls back to the raw key.
- remote-storage adapter POSTs with keepalive so the write survives the
  OAuth authorize redirect, surfaces swallowed persist failures, and gives
  richer read/write error messages.
- generateOAuthState throws instead of silently degrading to Math.random.
- NodeOAuthStorage honors MCP_INSPECTOR_OAUTH_STATE_PATH for isolated
  fixtures. Provider codeVerifier()/getServerMetadata() + the EMA idpOidc and
  connection-state readers await the now-async storage.

Web:
- environmentFactory + a new shared lib/remoteOAuthStorage accessor
  (memoized per {baseUrl, authToken}) wire RemoteOAuthStorage into the
  connection path, the EMA IdP hook, and the per-server "clear OAuth" action
  so all three share one in-memory view of oauth.json.

Tests: async-hydration + normalizeServerUrl suite, keepalive/error-path
coverage, and the sync→async migration across existing storage/provider/EMA
tests. Web validate + coverage gate + integration suite green; CLI/TUI/
launcher validate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

clients/web/src/utils/clearServerOAuthState.test.ts

@@ -1,50 +1,49 @@
-import { describe, it, expect, vi, beforeEach } from "vitest";
-import { getBrowserOAuthStorage } from "@inspector/core/auth/browser/index.js";
+import { describe, it, expect, vi } from "vitest";
 import { clearServerOAuthState } from "./clearServerOAuthState";
 
 describe("clearServerOAuthState", () => {
-  beforeEach(() => {
-    getBrowserOAuthStorage().clear("https://mcp.example.com/mcp");
-  });
-
-  it("clears storage by server URL when not the active connection", async () => {
-    const storage = getBrowserOAuthStorage();
-    await storage.saveTokens("https://mcp.example.com/mcp", {
-      access_token: "tok",
-      token_type: "Bearer",
-    });
+  it("clears storage by server URL when not the active connection", () => {
+    const oauthStorage = { clear: vi.fn() };
 
     const cleared = clearServerOAuthState({
       config: { type: "streamable-http", url: "https://mcp.example.com/mcp" },
       isActiveConnection: false,
+      oauthStorage,
     });
 
     expect(cleared).toBe(true);
-    expect(
-      await storage.getTokens("https://mcp.example.com/mcp"),
-    ).toBeUndefined();
+    expect(oauthStorage.clear).toHaveBeenCalledWith(
+      "https://mcp.example.com/mcp",
+    );
   });
 
   it("uses the live client when clearing the active connection", () => {
     const inspectorClient = {
       clearOAuthTokens: vi.fn(),
     };
+    const oauthStorage = { clear: vi.fn() };
 
     const cleared = clearServerOAuthState({
       config: { type: "streamable-http", url: "https://mcp.example.com/mcp" },
       inspectorClient: inspectorClient as never,
       isActiveConnection: true,
+      oauthStorage,
     });
 
     expect(cleared).toBe(true);
     expect(inspectorClient.clearOAuthTokens).toHaveBeenCalledTimes(1);
+    // The backend-backed store is not touched directly when a live client is
+    // present — the client owns resetting both persisted and in-memory state.
+    expect(oauthStorage.clear).not.toHaveBeenCalled();
   });
 
   it("returns false for stdio servers", () => {
+    const oauthStorage = { clear: vi.fn() };
     expect(
       clearServerOAuthState({
         config: { type: "stdio", command: "node", args: [] },
         isActiveConnection: false,
+        oauthStorage,
       }),
     ).toBe(false);
   });