fix(dashboard): add MCP auth to profile builder

[alt-glitch]

Summary

Follow-up to #65146 for the separate Create Profile wizard.

• bring the Profile Builder MCP step to parity with the main MCP page: typed HTTP/SSE vs stdio transport, None/Bearer/OAuth selection, password-style Bearer input, and stdio environment assignments
• refine the MCP picker with accessible segmented transport/auth controls, a responsive nested add-server form, a live configured count, and clearer server cards
• share frontend request construction between both Dashboard MCP forms so transport-specific fields cannot drift
• share backend request normalization between standalone MCP creation and profile creation while preserving the existing security rejection contract
• write Bearer secrets only to the new profile's .env while config.yaml retains the interpolated Authorization header
• preserve OAuth configuration for completion from the created profile's MCP page

Verification

• all required GitHub Actions checks pass, including all eight Python shards, web, Desktop, security/lint, and amd64/arm64 Docker jobs
• 138 affected backend tests passed after the final compatibility fix
• 76 Dashboard tests passed
• Dashboard TypeScript typecheck, targeted ESLint, and production build passed
• full Desktop check passed locally: 204 test files and 1,716 passing tests, plus packaging and production builds
• Ruff and diff whitespace checks passed

The backend coverage exercises Bearer-prefix stripping, profile-scoped .env persistence, safe config interpolation, OAuth persistence, stdio environment fields, invalid HTTP/auth combinations, and dangerous-entry rejection.