Auto-detect Cloudflare Access for remote MCP integrations

[mynameistito]

Related to #1764.

Requires #1764 to be fixed prior.

Summary

When adding a remote MCP server, detect when the endpoint appears to be protected by Cloudflare Access and automatically offer the standard Cloudflare Access Service Token authentication method.

Instead of requiring users to manually know and configure the relevant header names, Executor could recognize Cloudflare Access during the initial connection/discovery attempt and pre-populate:

CF-Access-Client-Id
CF-Access-Client-Secret

The user would then only need to provide the corresponding secret values.

Proposed behaviour

When Executor probes a remote MCP endpoint, inspect authentication responses for strong Cloudflare Access signals.

Examples include:

• A 401 response with a WWW-Authenticate Bearer challenge containing a Cloudflare Access resource_metadata URL such as:

https://<hostname>/.well-known/cloudflare-access-protected-resource/

• A redirect to a Cloudflare Access login endpoint such as:

https://<team>.cloudflareaccess.com/cdn-cgi/access/login/...

When detected, the MCP integration form could show something like:

Cloudflare Access detected
This endpoint appears to be protected by Cloudflare Access. Configure a Service Token to allow Executor to connect.

Then automatically add an authentication method with two header credential inputs:

CF-Access-Client-Id: <secret-backed value>
CF-Access-Client-Secret: <secret-backed value>