feat(web): migrate OAuth store to shared /store API (RemoteOAuthStorage parity) (closes #1548)

Migrate the web client's OAuth storage from BrowserOAuthStorage
(sessionStorage) to RemoteOAuthStorage, which POSTs through the backend's
/api/storage/oauth route to ~/.mcp-inspector/storage/oauth.json (mode 0600).
A credential obtained in the browser is now the same blob the TUI/CLI read
on the same host, giving web ⇄ TUI ⇄ CLI parity (Wave 1 of #1579).

Core (shared with TUI/CLI):
- OAuthStorageBase now drives a single async hydration (`ready()`,
  `getHydrationError()`); every post-redirect read (getClientInformation,
  getTokens, getCodeVerifier, getServerMetadata, getIdpSession) and every
  save awaits it so a late hydration merge cannot clobber a fresh write.
  getCodeVerifier/getServerMetadata become async; the store is created with
  skipHydration:true so there is no auto-hydration to race the explicit one.
- store.ts adds normalizeServerUrl so a token saved under
  https://Example.com/mcp is found when the CLI asks for
  https://example.com/mcp/; getServerState falls back to the raw key.
- remote-storage adapter POSTs with keepalive so the write survives the
  OAuth authorize redirect, surfaces swallowed persist failures, and gives
  richer read/write error messages.
- generateOAuthState throws instead of silently degrading to Math.random.
- NodeOAuthStorage honors MCP_INSPECTOR_OAUTH_STATE_PATH for isolated
  fixtures. Provider codeVerifier()/getServerMetadata() + the EMA idpOidc and
  connection-state readers await the now-async storage.

Web:
- environmentFactory + a new shared lib/remoteOAuthStorage accessor
  (memoized per {baseUrl, authToken}) wire RemoteOAuthStorage into the
  connection path, the EMA IdP hook, and the per-server "clear OAuth" action
  so all three share one in-memory view of oauth.json.

Tests: async-hydration + normalizeServerUrl suite, keepalive/error-path
coverage, and the sync→async migration across existing storage/provider/EMA
tests. Web validate + coverage gate + integration suite green; CLI/TUI/
launcher validate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

core/auth/store.ts

@@ -28,6 +28,26 @@ export interface ServerOAuthState {
   enterpriseManaged?: boolean;
 }
 
+/**
+ * Normalize a server URL to its canonical form for use as a store key.
+ *
+ * Different callers (web deep-link parser, CLI `--server-url`, the SDK's own
+ * client constructor) can present the same endpoint with cosmetic differences
+ * — host case, a trailing slash on a bare-origin URL, default-port omission —
+ * that `new URL().href` collapses. Keying by the canonical form means a token
+ * the web inspector saved under `https://Example.com/mcp` is found when the
+ * CLI later asks for `https://example.com/mcp/`. Non-URL strings (e.g. a
+ * stdio server name) are returned trimmed so the store still works for them.
+ */
+export function normalizeServerUrl(serverUrl: string): string {
+  const trimmed = serverUrl.trim();
+  try {
+    return new URL(trimmed).href;
+  } catch {
+    return trimmed;
+  }
+}
+
 /**
  * Zustand store state (all servers)
  */
@@ -59,26 +79,34 @@ export function createOAuthStore(
         servers: {},
         idpSessions: {},
         getServerState: (serverUrl: string) => {
-          return get().servers[serverUrl] || {};
+          const servers = get().servers;
+          // Look up by canonical key, falling back to the raw key so an
+          // already-persisted blob written before normalization existed (or by
+          // another writer) is still found.
+          return (
+            servers[normalizeServerUrl(serverUrl)] ?? servers[serverUrl] ?? {}
+          );
         },
         setServerState: (
           serverUrl: string,
           updates: Partial<ServerOAuthState>,
         ) => {
+          const key = normalizeServerUrl(serverUrl);
           set((state) => ({
             servers: {
               ...state.servers,
-              [serverUrl]: {
-                ...state.servers[serverUrl],
+              [key]: {
+                ...state.servers[key],
                 ...updates,
               },
             },
           }));
         },
         clearServerState: (serverUrl: string) => {
+          const key = normalizeServerUrl(serverUrl);
           set((state) => {
             const rest = { ...state.servers };
-            delete rest[serverUrl];
+            delete rest[key];
             return { servers: rest };
           });
         },
@@ -118,6 +146,11 @@ export function createOAuthStore(
       {
         name: "mcp-inspector-oauth",
         storage,
+        // OAuthStorageBase drives `persist.rehydrate()` itself so it can await
+        // (and catch errors from) the single hydration. Auto-hydration here
+        // would race the explicit one and could clobber a save that landed
+        // between them.
+        skipHydration: true,
       },
     ),
   );