feat: record tunneled MCP resource identifiers from the dashboard

[daviddanialy]

AIM-151. Stacked on #5905 (server).

Summary

Adds a Resource Identifier section to the tunneled MCP source Settings tab, following the existing Display Name section pattern (shared update mutation, same invalidation, mcp:write gate). The field records the server's RFC 9728 protected resource identifier; saving an empty value clears it. Includes the regenerated TypeScript SDK for the new resource_identifier field on the tunneled MCP create/update forms and server view.

Motivation

The server side (#5905) routes tunneled per-user credentials by this recorded identifier; this is the surface where an operator sets it. The copy states the safety contract — Gram never connects to the address — and that blank is correct for servers without their own OAuth.

🤖 Generated with Claude Code

https://claude.ai/code/session_015gm43HhrAUR6poQA5xKK9W

---

Summary by cubic

Adds a Resource Identifier section to the tunneled MCP source Settings tab so operators can record the server's RFC 9728 protected resource identifier, which routes user credentials to the server by exact match. Saving an empty value clears it.

Bug Fixes

• Since Settings sections share one update mutation, a failed save surfaced its error under whichever section the user did not touch; each section now keeps its own error and draft state.
• The resource identifier's mcp:write gate is scoped to the source's project, so a grant held on another project can't enable Save.

^{Written for commit 5646559. Summary will update on new commits.}

[linear-code]

AIM-151

[changeset-bot]

🦋 Changeset detected

Latest commit: 5646559

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
dashboard	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

All reported issues were addressed across 6 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[daviddanialy]

Superseded by 20df268 on #5905 — the dashboard work was folded into the server PR after a review pass reshaped it: the settings section is now a shared EditableFieldSection with per-section mutations, and the project-scoped RequireScope gate from 5646559 was dropped as ineffective (the check carries no projectId dimension, and it falsely denies server-scoped grants). The ui changeset rides along on #5905.