fix: MCP server OAuth form quick wins (read-only redirect URI, drop password grant) UI part

[marekdano]

Depends IBM/mcp-context-forge#5786

Summary

UI-side counterpart of IBM/mcp-context-forge#5786, split into this repo now that the client lives here. Delivers User Stories 1 and 4 of IBM/mcp-context-forge#5721 (Story 3 — pre-fill from the MCP initialize response — is deferred pending IBM/mcp-context-forge#5719; Story 2 was already satisfied server-side, no UI change needed).

• Redirect URI is displayed, not typed (Story 1): for authorization_code, the redirect URI field is now read-only and derived from the running app's own origin ({origin}/oauth/callback), with a copy-to-clipboard button
  and a warning when the derived/stored value is localhost/127.0.0.1 — a real misconfiguration if registered with an external IdP. The displayed value is lifted into form state via onRedirectUriChange so what's shown is
  exactly what gets submitted; a server response that already carries a redirect_uri is shown verbatim and never overwritten. This removes the copy-paste transcription error that used to silently break OAuth callbacks. (The
  corresponding backend default — initiate_oauth_flow/oauth_callback filling in a missing redirect_uri — already shipped in feat(python): MCP server OAuth form quick wins (read-only redirect URI, drop password grant) IBM/mcp-context-forge#5786.)
• Deprecated password grant hidden for new servers (Story 4): the resource owner password grant option is dropped from the grant-type selector unless it's already selected (i.e. an existing legacy config), in which case it's
  shown with a deprecation notice so a loaded config isn't silently changed out from under the user. Actual rejection for new registrations is enforced server-side in GatewayCreate (already merged in feat(python): MCP server OAuth form quick wins (read-only redirect URI, drop password grant) IBM/mcp-context-forge#5786)
  — this is the matching UI-side removal, not the enforcement boundary.
• i18n: all new/changed copy in OAuth2Auth.tsx is routed through react-intl (mcpServer.oauth2.* keys added to en-US, es-ES, pt-BR), matching this repo's localization convention — the original component predated
  it and used inline strings.

Test plan

• OAuth2Auth.test.tsx: read-only redirect URI renders the derived origin and is lifted into form state; a stored redirect_uri is shown verbatim and not overwritten; no redirect URI is set for non-authorization_code grants;
  the password grant option only appears (with the deprecation copy) when already selected.
• MCPServerForm.test.tsx: updated to match the new OAuth2Auth behavior.

[gcgoncalves]

The PR is in great shape, I'd just requested a minor performance update and a little more testing for:

1. Copy button interaction test
2. localhost warning tests

[gcgoncalves]

The useEffect includes onRedirectUriChange in dependencies, which could cause unnecessary re-runs if the parent doesn't memoize the callback:

useEffect(() => {
  if (grantType === "authorization_code" && !redirectUri) {
    onRedirectUriChange(derivedRedirectUri);
  }
}, [grantType, redirectUri, derivedRedirectUri, onRedirectUriChange]);

Risk: Parent component re-renders could trigger unnecessary effect runs

Recommendation:

// In parent component (MCPServerForm), wrap the callback:
const handleRedirectUriChange = useCallback((uri: string) => {
  setFormData(prev => ({ ...prev, redirectUri: uri }));
}, []);

Or use useCallback ref pattern:

const onRedirectUriChangeRef = useRef(onRedirectUriChange);
useEffect(() => {
  onRedirectUriChangeRef.current = onRedirectUriChange;
});

useEffect(() => {
  if (grantType === "authorization_code" && !redirectUri) {
    onRedirectUriChangeRef.current(derivedRedirectUri);
  }
}, [grantType, redirectUri, derivedRedirectUri]);