test: close ≥90% per-file coverage gaps for mid-session auth

The mid-session auth work passed `validate`/CI but failed the local-only
`npm run test:coverage` per-file gate (≥90% lines/statements/functions/
branches) on 12 files. Add targeted unit/integration tests so every changed
file clears the gate; annotate provably-dead defensive branches with justified
`/* v8 ignore */` comments rather than relaxing the gate.

Files brought to ≥90 on all four dimensions:
- core/auth: mcpAuth, oauthUx, utils, challenge, node/runner-interactive-oauth
- core/mcp: oauthManager, inspectorClient, node/authChallengeFetch,
  remote/remoteClientTransport, remote/node/{remote-session,server}
- clients/web/src/utils: oauthResume, browserTabVisibility

`npm run test:coverage` now passes (3575 tests, 0 threshold failures);
`npm run validate` green across all four clients.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DZyeWManYTvcXxjcrhxSQc

core/auth/node/runner-interactive-oauth.ts

@@ -76,6 +76,7 @@ export async function runRunnerInteractiveOAuth(
       onError: (params) => {
         flowReject(
           new Error(
+            /* v8 ignore next -- params.error is a required non-null string, so the "OAuth error" fallback is unreachable */
             params.error_description ?? params.error ?? "OAuth error",
           ),
         );
@@ -89,6 +90,7 @@ export async function runRunnerInteractiveOAuth(
       options.callbackTimeoutMs ?? DEFAULT_RUNNER_INTERACTIVE_OAUTH_TIMEOUT_MS;
     const waitForCallback = Promise.race([
       flowDone.finally(() => {
+        /* v8 ignore next 3 -- timeoutId is assigned synchronously while the race is constructed, before flowDone can settle, so the undefined arm is unreachable */
         if (timeoutId !== undefined) {
           clearTimeout(timeoutId);
         }