fix: surface list-fetch failures instead of swallowing them

A list load that failed — a transport error, or a result the SDK's era
codec rejects as invalid — reported nothing. The connect-time refresh is
fired with no caller to await it (`void this.refresh()`), so its rejection
became an unhandled rejection: the header said "Connected", the panel
rendered an empty list indistinguishable from a server that has none, and
the failed exchange showed in the Protocol panel as a clean success.

Two surfaces now tell the truth:

- ManagedListState records the failure as observable state (`getError` +
  an `errorChange` event) and still re-throws, so App's auth-recovery
  wrapper keeps working. The four `useManaged*` hooks expose it via a
  shared `useManagedListError`, and the Tools/Prompts/Resources sidebars
  render a `ListLoadError` alert with the reason and a Retry.
- A response the client refused is attributed back to its Protocol entry
  (`markResponseRejected` → `responseRejected` → `MessageEntry.clientError`),
  which now renders an Error status and a "Rejected by the Inspector"
  alert rather than the green resultType badge alone. The SDK gives no
  request id with a decode failure, so the id is recovered by correlation;
  see the comment on `markResponseRejected` for why that is exact.

Also stops `listAllTools` from dropping a failing excluded-tools walk on
the floor — it stays non-fatal but is logged.

Closes #1953

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SW1p8E2uiyyLx4RKwrwSrt

core/mcp/state/messageLogState.ts

@@ -98,6 +98,31 @@ export class MessageLogState extends TypedEventTarget<MessageLogStateEventMap> {
       pushEntry(entry);
     };
 
+    // A response the client rejected after the fact (the wire frame was valid
+    // JSON-RPC, but the SDK codec refused the result). Annotate the entry that
+    // carries that JSON-RPC id so it stops rendering as a clean success — the
+    // request entry when the response was folded into it, otherwise the
+    // standalone response entry. Searched newest-first: ids are unique within
+    // a session, and the failing exchange is by construction a recent one.
+    const onResponseRejected = (
+      event: TypedEventGeneric<InspectorClientEventMap, "responseRejected">,
+    ): void => {
+      const { id, reason } = event.detail;
+      for (let i = this.messages.length - 1; i >= 0; i--) {
+        const entry = this.messages[i]!;
+        const entryId = (entry.message as { id?: string | number }).id;
+        if (entryId !== id) continue;
+        if (entry.direction === "notification") continue;
+        // A request entry with no response yet isn't the one being rejected —
+        // keep looking for the standalone response frame.
+        if (entry.direction === "request" && !entry.response) continue;
+        entry.clientError = reason;
+        this.dispatchTypedEvent("message", entry);
+        this.dispatchTypedEvent("messagesChange", this.getMessages());
+        return;
+      }
+    };
+
     const onStatusChange = (): void => {
       if (isTerminalStatus(this.client?.getStatus())) {
         this.messages = [];
@@ -106,10 +131,12 @@ export class MessageLogState extends TypedEventTarget<MessageLogStateEventMap> {
       }
     };
     this.client.addEventListener("message", onMessage);
+    this.client.addEventListener("responseRejected", onResponseRejected);
     this.client.addEventListener("statusChange", onStatusChange);
     this.unsubscribe = () => {
       if (this.client) {
         this.client.removeEventListener("message", onMessage);
+        this.client.removeEventListener("responseRejected", onResponseRejected);
         this.client.removeEventListener("statusChange", onStatusChange);
       }
       this.client = null;