feat: add OAuth 2.0 client certificate authentication (private_key_jwt)

[harishkaushal30]

Summary

Add support for OAuth 2.0 certificate-based authentication using the \private_key_jwt\ method (RFC 7523) as an alternative to client secret. This enables MCP servers protected by OAuth providers that require certificate auth (e.g., Azure AD/Entra ID with SNI).

Changes

Server

• *\POST /oauth/token/certificate* — Server-side endpoint that builds a JWT client assertion (RS256, with \x5t\ thumbprint and \x5c\ certificate chain claims), then exchanges the authorization code for tokens at the provider's token endpoint. Private keys never touch the browser.
• *\GET /oauth/discover?url=...* — Proxy endpoint for CORS-free OAuth endpoint discovery. Fetches .well-known/oauth-protected-resource\ metadata from the MCP server and resolves authorization/token endpoints via OIDC .well-known/openid-configuration. Tries multiple well-known URL patterns (path-prepended, path-appended, root fallback).

Client

• Auth method toggle — Secret/Certificate selector in the OAuth section of the sidebar
• Endpoint discovery toggle — Auto-discover from metadata (default) or enter manually
• Certificate fields — Certificate file path, private key file path inputs
• Transport auth bypass — For cert auth, the SDK's built-in auth provider is not passed to transports, preventing CORS issues and Azure AD's
  esource\ parameter conflict (\AADSTS9010010). Auth is handled via \handleAuthError\ using the proxy discovery endpoint.
• State management — All cert config persisted to localStorage before OAuth redirect, read back by OAuthCallback on return

Tests

• 10 new Sidebar tests for certificate auth UI (method selector, cert/key fields, endpoint source toggle, auto-discover vs manual, input callbacks)
• Updated existing Sidebar test defaultProps with cert auth fields
• All 497 tests pass (28 suites)

Documentation

• Updated README.md Authentication section with subsections for Bearer Token, OAuth with Client Secret, and OAuth with Client Certificate

Compatibility

Works with any OAuth 2.0 provider supporting \private_key_jwt\ client authentication:

• Azure AD / Microsoft Entra ID (tested, including SNI)
• Okta
• Auth0
• Keycloak

How to test

1. Configure an OAuth app with certificate credentials on your provider
2. Select Client Certificate in the Authentication Method dropdown
3. Provide Client ID, cert path, key path, and scope
4. Choose auto-discover (if MCP server publishes protected resource metadata) or enter endpoints manually
5. Click Connect — the inspector handles the full Authorization Code + PKCE flow with JWT client assertion