Web integration tests read and write the developer's real ~/.mcp-inspector OAuth state file #2670

Problem

clients/web/src/test/integration/auth/node/storage.test.ts and clients/web/src/test/integration/helpers/oauth-client-fixtures.ts construct NodeOAuthStorage() / call getStateFilePath() with no path and with neither MCP_INSPECTOR_OAUTH_STATE_PATH nor MCP_STORAGE_DIR set, so they resolve to DEFAULT_STATE_PATH — the real ~/.mcp-inspector/storage/oauth.json of whoever runs the suite.

Two consequences:

1. It touches real user state. clearAllOAuthClientState() in "clearAllOAuthClientState clears every server in the default store" clears every server in that file, and the suites rewrite it and its oauth.json.namespaces.json ledger. A developer who uses the Inspector on the same machine can lose their stored OAuth state by running npm run local:gate. Observed: both files' mtimes moved to the minute the gate's integration project ran.
2. It flakes the gate. Every forks-pool worker that reaches the default path, and any other Inspector process or worktree session on the machine, shares that one file. During local:gate on Mixing 2.9.x and 2.10 on one OAuth state file strands a confidential DCR client's secret #2630 that test failed once (expected { access_token: 'a', … } to be undefined at storage.test.ts:595, so clear never saw server-a in the file it read) and then passed 3/3 in isolation, both with and without that branch's change.

Reproduce

1. Note the mtime of ~/.mcp-inspector/storage/oauth.json.
2. cd clients/web && npx vitest run --project integration src/test/integration/auth/node/storage.test.ts
3. The mtime has moved, and the file now holds the tests' http://server-*.test entries, or none of yours.

Expected

No test reads or writes anything under the developer's real home directory. The integration project (or these suites) should point MCP_STORAGE_DIR / MCP_INSPECTOR_OAUTH_STATE_PATH at a per-worker temp directory, and a test that exercises default-path resolution should assert the resolved path rather than write to it.