feat(apps): make the BYO URL card the guided universal flow

Pasting an MCP URL now walks the operator through whatever the endpoint turns out
to need. The simple path is unchanged in length — address, name, "does it need a
key?" — but the dead ends are gone: an endpoint that wants browser sign-in goes
to sign-in instead of a "coming soon" toast, and an invalid, private-network,
unreachable, or credential-demanding endpoint says which of those it was and
which field to change, inline, next to that field.

Advanced authentication adds the explicit choices for operators who already know:
no sign-in, key or token, custom headers, or browser sign-in with a client they
registered themselves. Header values become Paperclip secrets and are rejected
client-side before a round trip if Paperclip wouldn't send them. The choices are
phrased as how the *server* authenticates; nothing on this screen mentions DCR,
CIMD, PKCE or an RFC, and a test asserts that stays true.

The endpoint host and "Unverified server" now ride on the step header, so they
stay visible through review, access and install rather than only on the screen
where the address was pasted. A curated definition matching the endpoint is
offered as a branded shortcut beside — not instead of — the generic form.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

packages/shared/src/validators/index.ts

@@ -868,6 +868,8 @@ export {
   GENERIC_MCP_AUTH_MODES,
   genericMcpAuthModeSchema,
   genericMcpOAuthClientSchema,
+  type GenericMcpAuthMode,
+  type GenericMcpOAuthClient,
   reconnectToolAppSchema,
   finishToolAppSchema,
   updateToolApplicationSchema,