fix: surface list-fetch failures instead of swallowing them

A list load that failed — a transport error, or a result the SDK's era
codec rejects as invalid — reported nothing. The connect-time refresh is
fired with no caller to await it (`void this.refresh()`), so its rejection
became an unhandled rejection: the header said "Connected", the panel
rendered an empty list indistinguishable from a server that has none, and
the failed exchange showed in the Protocol panel as a clean success.

Two surfaces now tell the truth:

- ManagedListState records the failure as observable state (`getError` +
  an `errorChange` event) and still re-throws, so App's auth-recovery
  wrapper keeps working. The four `useManaged*` hooks expose it via a
  shared `useManagedListError`, and the Tools/Prompts/Resources sidebars
  render a `ListLoadError` alert with the reason and a Retry.
- A response the client refused is attributed back to its Protocol entry
  (`markResponseRejected` → `responseRejected` → `MessageEntry.clientError`),
  which now renders an Error status and a "Rejected by the Inspector"
  alert rather than the green resultType badge alone. The SDK gives no
  request id with a decode failure, so the id is recovered by correlation;
  see the comment on `markResponseRejected` for why that is exact.

Also stops `listAllTools` from dropping a failing excluded-tools walk on
the floor — it stays non-fatal but is logged.

Closes #1953

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SW1p8E2uiyyLx4RKwrwSrt

clients/web/src/components/groups/ToolControls/ToolControls.test.tsx

@@ -183,4 +183,29 @@ describe("ToolControls", () => {
     );
     expect(screen.getByText("invalid_header_tool")).toBeInTheDocument();
   });
+
+  // A failed load is rendered above the list instead of leaving the panel
+  // empty, which is indistinguishable from a server that has none (#1953).
+  it("renders a failed load above the list and retries via onRefreshList", async () => {
+    const user = userEvent.setup();
+    const onRefreshList = vi.fn();
+    renderWithMantine(
+      <ToolControls
+        {...baseProps}
+        loadError={new Error("codec said no")}
+        onRefreshList={onRefreshList}
+      />,
+    );
+
+    expect(screen.getByText("Couldn't load tools")).toBeInTheDocument();
+    expect(screen.getByText("codec said no")).toBeInTheDocument();
+
+    await user.click(screen.getByRole("button", { name: "Retry" }));
+    expect(onRefreshList).toHaveBeenCalledTimes(1);
+  });
+
+  it("renders no load error by default", () => {
+    renderWithMantine(<ToolControls {...baseProps} />);
+    expect(screen.queryByText(/Couldn't load/)).not.toBeInTheDocument();
+  });
 });