feat(registry): add Registry tab with server-side OAuth credential protection

[khandrew1]

Summary

• Adds a curated Registry tab in the sidebar for one-click connection to first-party MCP servers (Asana, GitHub, Notion, Linear, Jira)
• Server-side credential injection: OAuth client_secret is fetched from Convex and injected during token exchange in the Hono proxy — secrets never reach the browser
• registryManaged flag keeps registry servers out of the Servers tab and skips workspace sync
• registrySlug is threaded through the OAuth flow (stored in localStorage to survive full-page redirects)

Changes

Client

• RegistryTab.tsx — New component showing server cards with connect/disconnect, connection status badges
• mcp-sidebar.tsx — Added "Registry" entry to sidebar navigation
• App.tsx — Wired RegistryTab with onConnect, onDisconnect, and servers props
• hosted-tab-policy.ts — Added registry to allowed hosted tabs
• mcp-oauth.ts — Threaded registrySlug through initiateOAuth, handleOAuthCallback, refreshOAuthTokens, and clearOAuthData; parameterized fetch interceptor to include slug in proxy requests
• app-types.ts — Added registryManaged and registrySlug to ServerWithName
• types.ts — Added registryManaged and registrySlug to ServerFormData

Server

• oauth.ts — Proxy route accepts registrySlug, injects client_secret for registry servers during token exchange
• oauth-proxy.ts — Added isTokenExchangeUrl() and fetchRegistryCredentials() helpers

Hooks

• use-server-state.ts — Skips Convex workspace sync and UPDATE_WORKSPACE dispatch for registry-managed servers; typed oauthOptions as MCPOAuthOptions

Companion PR

Backend changes (schema, seed, credentials endpoint, icon storage) in mcpjam-backend repo.

Test plan

• Registry tab loads with 5 server cards (Asana, GitHub, Notion, Linear, Jira)
• SVG icons render from Convex storage
• Clicking "Connect" on a registry server initiates OAuth flow
• Token exchange succeeds (Hono injects client_secret server-side)
• Connected servers show "Connected" badge + "Disconnect" button
• Registry servers do NOT appear in the Servers tab
• Disconnecting a registry server returns card to "Connect" state
• No secrets visible in browser DevTools network tab

🤖 Generated with Claude Code

[chelojimenez]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.