feat(web): migrate OAuth store to shared /store API (RemoteOAuthStorage parity) (closes #1548)

Migrate the web client's OAuth storage from BrowserOAuthStorage
(sessionStorage) to RemoteOAuthStorage, which POSTs through the backend's
/api/storage/oauth route to ~/.mcp-inspector/storage/oauth.json (mode 0600).
A credential obtained in the browser is now the same blob the TUI/CLI read
on the same host, giving web ⇄ TUI ⇄ CLI parity (Wave 1 of #1579).

Core (shared with TUI/CLI):
- OAuthStorageBase now drives a single async hydration (`ready()`,
  `getHydrationError()`); every post-redirect read (getClientInformation,
  getTokens, getCodeVerifier, getServerMetadata, getIdpSession) and every
  save awaits it so a late hydration merge cannot clobber a fresh write.
  getCodeVerifier/getServerMetadata become async; the store is created with
  skipHydration:true so there is no auto-hydration to race the explicit one.
- store.ts adds normalizeServerUrl so a token saved under
  https://Example.com/mcp is found when the CLI asks for
  https://example.com/mcp/; getServerState falls back to the raw key.
- remote-storage adapter POSTs with keepalive so the write survives the
  OAuth authorize redirect, surfaces swallowed persist failures, and gives
  richer read/write error messages.
- generateOAuthState throws instead of silently degrading to Math.random.
- NodeOAuthStorage honors MCP_INSPECTOR_OAUTH_STATE_PATH for isolated
  fixtures. Provider codeVerifier()/getServerMetadata() + the EMA idpOidc and
  connection-state readers await the now-async storage.

Web:
- environmentFactory + a new shared lib/remoteOAuthStorage accessor
  (memoized per {baseUrl, authToken}) wire RemoteOAuthStorage into the
  connection path, the EMA IdP hook, and the per-server "clear OAuth" action
  so all three share one in-memory view of oauth.json.

Tests: async-hydration + normalizeServerUrl suite, keepalive/error-path
coverage, and the sync→async migration across existing storage/provider/EMA
tests. Web validate + coverage gate + integration suite green; CLI/TUI/
launcher validate green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S3fTN8H3R8YV4yUGvZjYnX

core/storage/adapters/remote-storage.ts

@@ -42,7 +42,9 @@ export function createRemoteStorageAdapter(
         if (res.status === 404) {
           return null;
         }
-        throw new Error(`Failed to read store: ${res.status}`);
+        throw new Error(
+          `Failed to read store '${options.storeId}' from ${baseUrl}/api/storage/${options.storeId}: ${res.status}`,
+        );
       }
 
       const store = await res.json();
@@ -62,16 +64,32 @@ export function createRemoteStorageAdapter(
         headers["x-mcp-remote-auth"] = `Bearer ${options.authToken}`;
       }
 
-      // Zustand gives us the full persisted format as a string
-      // Store it as-is (the API treats it as an opaque blob)
-      const res = await fetchFn(`${baseUrl}/api/storage/${options.storeId}`, {
-        method: "POST",
-        headers,
-        body: value, // Already a JSON string from Zustand
-      });
+      const url = `${baseUrl}/api/storage/${options.storeId}`;
+      try {
+        // Zustand gives us the full persisted format as a string
+        // Store it as-is (the API treats it as an opaque blob).
+        // `keepalive` lets this POST outlive an immediately-following
+        // full-page navigation (the OAuth authorize redirect): without it the
+        // browser may abort the request mid-flight and the just-saved
+        // codeVerifier/clientInformation never reaches disk.
+        const res = await fetchFn(url, {
+          method: "POST",
+          headers,
+          body: value, // Already a JSON string from Zustand
+          keepalive: true,
+        });
 
-      if (!res.ok) {
-        throw new Error(`Failed to write store: ${res.status}`);
+        if (!res.ok) {
+          throw new Error(
+            `Failed to write store '${options.storeId}' to ${url}: ${res.status}`,
+          );
+        }
+      } catch (err) {
+        // Zustand's persist middleware swallows setItem rejections — without
+        // this the user sees a green "Connected" while the token never landed
+        // on disk. Surface the failure so it's at least observable.
+        console.error("[remote-storage] persist write failed:", err);
+        throw err;
       }
     },
     removeItem: async (_name: string) => {