#8036 feat: create auth clients and offer them on more servers

AIM-596 (1 of 5)

Summary

• New authClients methods (org admin, audited):
  • create: a remote_session or service_account client over an existing OAuth registration whose credential owner matches the type (subject / self), or a static_credential / pass_through client with its own headers. Optionally offered on servers in the same call. ema clients still come only from EMA setup.
  • attachToMcpServer: offer an existing client on another server instead of copying it. Refused for hosted toolsets, unproxied servers, header clients on tunneled servers, project clients on another project's server, and servers that declare they need no upstream auth.
  • setHeaders: replace an administrator-created client's headers. A secret header sent without a value keeps its stored value, so rotating one secret doesn't require re-entering the others. Clients the backfill copied from server settings are refused: they keep following those settings until cleanup.
• Header rules: secrets are stored encrypted and never returned. Token-generating clients cannot configure Authorization. Static credentials send only stored values, pass-through clients only forward caller headers. The remote-header policy applies (no forwarding the inbound Authorization, cookies or Speakeasy headers). Names must be unique, ignoring case and _/-.
• Audit: auth-client:create, auth-client:attach-mcp-server and auth-client:update-headers. Snapshots carry no header values.
• Resolver: GetAuthClientSelection checks a client against server settings only when it is a backfilled copy reached through a backfilled association. Administrator-created clients and associations are authoritative. They are no longer read as stale header copies or missing legacy registration links, so they resolve under enforcement. Backfilled copies are checked exactly as before.
• Platform MCP: new offer_mcp_upstream_credential tool, beside set_mcp_role_auth_client_access (org admin, explicit project, confirmation, rate budget, audited, live read of the server's upstream authentication after the change). Creating credentials and entering secret values is left out on purpose, so secrets never pass through an agent conversation. get_mcp_connection_settings already lists created and attached clients.
• Staff Admin MCP: no change. describe_mcp_server_health already lists each client with its source and server count.
• Demo seed: the shared "Engineering automation token" is now administrator-created, and GitHub also offers "Your own GitHub token", a pass-through. GitHub and Linear each offer two clients for the consent picker that follows.

Motivation

Milestone 3 lets a server offer several upstream identities. Until now auth clients existed only as backfilled copies of each server's settings, so an admin could not add a service account next to personal connections or share one credential across servers. This is the API the dashboard and consent picker in the next PRs build on. As with the rest of the typed configuration, a client takes effect only in organizations where upstream auth enforcement is on.