fix(studio): simplify MCP credential editing

[zyn080302]

Summary

• remove the MCP credential-mode choice box from Runtime Agent editing
• restore authorized saved MCP Bearer Tokens into the masked editor field through an ownership-checked, etag-bound POST/no-store endpoint while keeping ordinary detail responses redacted
• retain the current Token when the MCP URL changes; clearing the field explicitly removes authentication
• make debug, update, and publish consume the same explicit in-memory Draft credential state without browser persistence

Verification

• cd frontend && npm test: 1052 passed
• cd frontend && npm run build: passed in 36.54s
• cd frontend && npm run test:harness-sidecar-coverage: 22 passed; 98.55% statements / 94.44% branches
• Runtime RBAC + legacy recovery: 192 passed
• Studio six-case lifecycle gate: 8 passed
• MCP debug/deploy release gate: 38 passed
• packaged WebUI assets: 102 files and 246 internal references verified
• pre-commit Ruff, format, and hardcoded-secret checks: passed
• Pyright retains existing repository baseline diagnostics; no diagnostic points to the new credential route/helper lines

Security

Credential values are returned only for an authorized immutable Runtime/app/etag snapshot, via POST with no-store/no-cache headers. They remain in React memory, are masked by default, and are excluded from local draft persistence, logs, ordinary Runtime detail APIs, generated source, and documentation.