OAuth pre-redirect auth HTTP activity missing from Network tab (lost across redirect)

[cliffhall]

Problem

After #1379 wired the OAuth flow, the Network tab shows the post-redirect auth HTTP (discovery re-run + POST /token from completeOAuthFlow) but not the pre-redirect half — the protected-resource + authorization-server discovery and the Dynamic Client Registration POST /register that run during authenticate() on the page that then redirects to the auth server. That page's FetchRequestLogState is destroyed on navigation, so those auth entries never reach the connected page.

Root cause (confirmed empirically)

FetchRequestLogState + RemoteInspectorClientStorage are designed to persist the fetch log across the redirect (save on the client's saveSession event keyed by the OAuth authId, restore on the /oauth/callback rebuild). But the ordering defeats it:

• BaseOAuthClientProvider.redirectToAuthorization (core/auth/providers.ts:234) sets window.location.href inside the SDK's auth().
• OAuthManager.authenticate only calls onBeforeOAuthRedirect → saveSession after auth() returns (core/mcp/oauthManager.ts:138).

By the time the save fires, the document is already unloading, so the save never reaches the backend (verified: no inspector-session-* file is written, even though a keepalive POST dispatched before navigation persists fine, and /api/storage works manually).

Fix plan

Persist the session synchronously, before navigation:

1. BrowserNavigation — run a synchronous beforeNavigate(url) hook before window.location.href.
2. createWebEnvironment — accept an onBeforeOAuthRedirect hook and pass it to BrowserNavigation.
3. App.tsx — wire the hook to flush the active FetchRequestLogState entries to RemoteInspectorClientStorage (keepalive POST, keyed by the authId parsed from the auth URL).
4. FetchRequestLogState.hydrateFetchRequests — merge restored entries instead of replacing, to avoid a restore-vs-live-append race on the callback page.
5. RemoteInspectorClientStorage.saveSession — use keepalive: true so the save outlives the unloading document.

Acceptance criteria

• After a first-time OAuth connect, the Network tab on the connected page shows the full handshake: pre-redirect discovery + DCR /register, plus post-redirect discovery + /token, all as auth, alongside transport.
• No regression to non-OAuth servers or to the OAuth connection itself (Wire up OAuth flow in App.tsx: authenticate, oauthAuthorizationRequired listener, /oauth/callback handler #1379).

Notes

Stacked on #1383 (#1379). Independent of #1378.