feat(frontend): add mcp connection settings, oauth consent, and mcp inspector ui

[jog1t]

• Add an MCP connection settings card to namespace settings, with a scope selector that controls how tightly the generated endpoint is pinned.
• Add an OAuth consent route that shows the requesting client name, the requested scopes with descriptions, and which account is being granted access.
• Add a standalone MCP build of the inspector UI (entry, HTML shell, and Vite config) so the inspector can run inside a sandboxed MCP app frame.
• Gate the MCP connection surface behind a feature flag so each deployment flavor can enable it independently.
• Add the better-auth OAuth provider, MCP SDK, MCP ext-apps, and vite-plugin-singlefile dependencies.

[railway-app]

🚅 Deployed to the actors-pr-5616 environment in rivet-frontend

Service	Status	Web	Updated (UTC)
kitchen-sink	😴 Sleeping (View Logs)	Web	Aug 28, 2026 at 7:01 pm
frontend-cloud	😴 Sleeping (View Logs)	Web	Aug 28, 2026 at 6:59 pm
frontend-inspector	😴 Sleeping (View Logs)	Web	Aug 28, 2026 at 6:58 pm
ladle	✅ Success (View Logs)	Web	Aug 28, 2026 at 6:52 pm
website	❌ Build Failed (View Logs)	Web	Aug 28, 2026 at 6:50 pm
mcp-hub	✅ Success (View Logs)	Web	Aug 28, 2026 at 5:51 pm

[claude]

Review: feat(frontend): MCP connection settings (updated after 1908ea6)

Re-reviewed after the "address review" commit. All three previously-flagged items are resolved:

• Session revocation gap, fixed. frontend/apps/inspector-ui/src/mcp-main.tsx now serializes grant swaps through sessionSwap and revokes the superseded grant inside replaceSession before returning the new one. The chaining is careful: sessionSwap is reassigned to a swallowed-rejection copy of swap so the chain never wedges on a failed createSession/revokeSession, while the original swap promise (returned to the caller) still surfaces the rejection to receiveResult's .catch. currentGrant is only updated after createSession succeeds, so a failed swap correctly leaves the previous (still-valid, unrevoked) grant in place. Nice fix, and the comment above sessionSwap explains the why well.
• oauth.consent.tsx form state, fixed. Checkboxes are now wired through useForm + Controller, matching the root CLAUDE.md rule about not hand-rolling controlled-input state.
• oauth.consent.tsx async submit, fixed. The consent call now goes through useMutation, matching frontend/CLAUDE.md's rule to avoid hand-rolled pending/error state.
• .claude/reference/feature-flags.md now documents the mcp flag and its flavor-dependent content, and the dev-console snippets include an OSS+mcp example.
• frontend/package.json ordering, the new deps (@better-auth/oauth-provider, @modelcontextprotocol/ext-apps, @modelcontextprotocol/sdk) now sit in correct alphabetical position.

Remaining minor items (non-blocking)

• frontend/apps/inspector-ui/vite.mcp.config.ts: the disable-unsupported-mcp-console-worker plugin gained a buildEnd assertion that fails the build if the worker-import stub never matched, which is good. The sibling fallback-unavailable-mcp-icons plugin still has no equivalent assertion; if @rivet-gg/icons' generated export shape changes, the fallback silently no-ops rather than failing the build. Same class of coupling as before, just half-addressed.
• The exact-pinned versions in package.json (1.6.23, 1.7.4, 1.29.0, 2.3.3) vs. the file's prevailing caret-range style are unchanged. Likely intentional (matching @better-auth/oauth-provider's peer dependency on an exact better-auth version), just flagging again in case it was not a deliberate choice for all four.
• Still no direct test/story coverage for mcp-connection.tsx, oauth.consent.tsx, or the mcp-main.tsx session lifecycle (only mcp-scope.ts has unit tests). Given the revocation logic that was just fixed lives in exactly this untested lifecycle code, a small test for replaceSession's swap/revoke ordering would guard against regressions here, though NAPI/MCP-host-shaped code is harder to unit test than the pure mcp-scope.ts helpers.

Nothing here blocks merge. The credential-lifecycle bug from the previous round is resolved and the convention fixes look correct.