Add MCP server authentication to inspector

[abewheel]

Summary

• Adds Bearer token and OAuth authentication support to the inspector sidebar for connecting to authenticated MCP servers.
• Bearer auth adds an Authorization header to the transport. OAuth uses the MCP SDK's auth() flow with PKCE, dynamic client registration, and an in-memory provider on the dev server.
• The OAuth popup callback uses postMessage with a BroadcastChannel fallback for providers that set Cross-Origin-Opener-Policy headers.
• Includes optional client ID/secret and scopes inputs for servers that require pre-registered credentials or specific scopes.
• Auth UI is hidden in demo mode, bearer token input is password-masked, and all auth endpoints are gated behind method checks.

Test plan

• Verify bearer token auth connects to a token-protected MCP server
• Verify OAuth flow completes against a real OAuth-protected MCP server
• Verify popup blocked detection shows a clear error message
• Verify auth section is hidden in demo mode
• Verify switching auth type to "None" reconnects without credentials
• Unit tests pass: pnpm --filter sunpeak test -- --run