Implement Figma Remote MCP connector editor

[vpulim]

Summary

Replace connector authoring with the Figma Remote MCP design. New connectors use the remote MCP form; existing API, CLI, and local MCP connectors retain their original editor and capability data.

Changes

• Add progressive OAuth client, request header, and connection detail disclosures, with a scrolling form and fixed actions. Support automatic, CIMD, DCR, and custom OAuth clients, saved-secret replacement, and text header actions.
• Store header values and client secrets in the credential vault. Carry header bindings through connector resolution, host/runner configuration, and the credential proxy, bound to the selected resource host.
• Preserve unsurfaced capabilities, saved hosts, admin sharing/default settings, and existing OAuth references. Display known hosts separately and add optional hosts without removing existing permissions. Require full connector loading before editing.
• Initialize the legacy editor synchronously from that loaded connector. Eliminate its redundant second fetch, which could expose summary-only data to Save and erase CLI packages or stdio servers. Regression tests stall repeated GETs and save immediately after the form appears.
• Backport node-forge's proposed fix for GHSA-86w9-cpqp-85rv, which caused the CI audit failure after all tests passed. Pin 1.4.0 and exclude only that locally patched advisory from the version-based audit; no fixed npm release is available. Document removal of the patch/exception after upgrading both consumers.

Internal change — no new service hooks or hook signature changes. No new plugins.

Test plan

• Root TypeScript build and channel-web production build.
• ESLint on changed code; 22 ESLint-rule tests and 1,100 script tests.
• 267 web tests covering connector forms, OAuth, credentials, and settings.
• Focused regressions in connectors, mcp-oauth, chat-orchestrator, credential-proxy, sandbox-subprocess, agent-runner-core, and skill-broker; sandbox-protocol and skills-parser suites.
• Browser walkthrough through Settings using intercepted APIs: desktop/mobile, short viewports, light/dark themes, OAuth choices, headers, saving/reopening, and keyboard behavior.
• All 499 credential-proxy tests; malformed-signature regressions reproduced against the unpatched dependency and pass against both installed patched consumers. Frozen-lockfile install and pnpm audit --audit-level moderate pass (only the patched advisory is ignored).
• All 1,458 web component tests, including deterministic API/CLI/stdio preservation with repeated connector fetches stalled. Channel-web build and changed-code lint pass after eliminating the loading race.
• CI run on 7c2b15f5: all checks passed, including affected packages/dependents, dependency audit, Docker builds, CodeQL, Semgrep, and Gitleaks.

Security review

• Sandbox: Custom headers remain explicitly bound to the remote MCP resource host. Secrets stay in the vault; sandbox configuration carries validated placeholders, with no new filesystem or process access.
• Injection: React escapes form content. Validators reject reserved/duplicate headers and malformed bindings; the credential proxy rejects control bytes before substitution. Existing ownership, OAuth state/PKCE, and destination checks remain enforced.
• Supply chain: Existing node-forge is pinned to 1.4.0 in both consumers and patched with the exact lib/rsa.js change from upstream PR #1152 (still open). Established Digital Bazaar package; no added transitive dependencies or install-time hooks (its prepublish build is not an install hook). The unconditional scripts suite verifies valid and malformed signatures in both consumers and the narrow audit configuration. All other audit findings still fail CI. Browser verification uses Playwright installed outside the repository.