feat(catalog): add OAuth server setup flow

[vishu-bh]

Summary

• Add an OAuth-specific catalog setup dialog built from existing shadcn primitives.
• Register credentials, launch authorization, enable the server, then discover tools.
• Surface caller-scoped OAuth status and re-authorization actions on catalog cards.

Backend dependency

Requires backend PRs #6588 and #6620. Handwritten frontend contract types are temporary until OpenAPI generation includes the merged API.

Validation

• npm run lint -- --max-warnings=0
• npx tsc --noEmit
• npm run test -- --run src/pages/ServerCatalog.test.tsx src/components/server-catalog/CatalogResults.test.tsx src/api/catalog.test.ts

NOTE

Please do not merge this till backend dependency is resolved. For the purpose of development handwritten contracts is added but it needs to be cleaned up once backend dependency is resolved

[marekdano]

1. 🔴 High — OAuth popup blocked on first-time setup

File: src/pages/ServerCatalog.tsx:638

handleOAuthSubmit does await registerServer(...) (an HTTP POST) before calling serversApi.triggerOAuthAuthorization(gatewayId). By the time window.open() runs inside that call, the browser no longer treats it as a direct response to the click, so popup blockers will block it (authWindow is null) — this will trigger on essentially every first-time OAuth registration.

Failure scenario: User clicks "Configure and authorize" on a new OAuth catalog server → popup blocked → "Failed to open OAuth authorization window" error. Retrying then hits the pendingOAuthGatewayId fast path, which calls triggerOAuthAuthorization synchronously and succeeds — so it looks like a transient glitch but is actually deterministic.

---

2. 🟠 Medium-High — Removed auth-type filter exposes unsupported servers

File: src/pages/ServerCatalog.tsx:454

The catalog's auth-type allow-list filter (previously SUPPORTED_AUTH_TYPE_SET) was removed. supportedServers = data?.servers ?? [] no longer filters by auth type, so servers with types outside Open/API Key/OAuth (e.g. Basic, mTLS) now render and are "Add"-able.

Failure scenario: Clicking "Add" on such a server falls through handleAdd's if/else chain straight to void registerServer(server) with no credentials — likely a generic server-side failure, or a silent no-auth registration. No test covers this path.

---

3. 🟡 Medium — Disconnect/Test not blocked during in-flight authorization

File: src/components/server-catalog/CatalogResults.tsx:202

The new Authorize action shares the isAdding pending flag with Test and Disconnect, but Test's/Disconnect's own disabled conditions were never updated to also check isAdding.

Failure scenario: User clicks Authorize (popup opens, isAdding true) → reopens the dropdown and clicks Disconnect (only checks isTesting || isDisconnecting) → gateway is deleted mid-authorization → when the popup resolves, toggleEnabled/fetchToolsAfterOAuth run against a deleted gateway id, surfacing a confusing error instead of being prevented up front.