Studio: clearer MCP server validation when stdio is disabled

[oobabooga]

Follow-up to #5863 (stdio MCP server support), after @Datta0's comment: #5863 (comment)

Problem

The "URL or command" field accepts an http(s):// URL or, where stdio is enabled, a local command (e.g. npx -y @modelcontextprotocol/server-filesystem /tmp). On a host where stdio is off, typing a command was rejected with "url must start with http:// or https://". For a command that reads as "your command is a malformed URL" and doesn't explain the real reason.

Changes

This only changes the rejection message. What gets accepted is unchanged.

• The message now guides the user to an http(s):// URL and gives an example.
• It only adds "running a local command is not enabled on this server" when the value contains whitespace. Whitespace is the one reliable signal that something is a command, since a URL can't contain a space. A lone token like example.com may just be a URL missing its scheme, so the message doesn't assume it was a command.
• It no longer says "desktop only", since self-hosted hosts can opt in via an env var.

Notes

Backend only. Tests added.

[gemini-code-assist]

Code Review

This pull request refactors the MCP server URL validation logic by introducing a helper function _looks_like_command to check for whitespace, which helps distinguish between URLs and local commands. The validation error message has been improved to clearly state when local commands are disabled on the server. Corresponding unit tests have been added and updated to verify these changes and ensure backward compatibility for ambiguous lone tokens. There are no review comments, and I have no feedback to provide.