docs: MCP App review recipe + README updates for new CLI flags, deep-links, and proxy support

[cliffhall]

Summary

Documentation roll-up for the programmatic-review surface, once the features exist:

• docs/mcp-app-review.md — the CLI-first → one-shot-web recipe: probe with --app-info, construct the deep link, drive the rendered widget; plus §5 OAuth-gated servers (stored-auth handoff), §6 SSH port-forward (both ports), §7 HTTP proxy.
• clients/cli/README.md — new flags (--format json, --tool-args-json, --connect-timeout, --app-info, --method initialize, stored-auth suite), the exit-code map, env vars (MCP_INSPECTOR_OAUTH_STATE_PATH, MCP_STORAGE_DIR, proxy vars).
• clients/web/README.md — deep-link URL scheme + token gate, the data-testid/data-* driver contract, sandbox isolation model updates.
• Main README.md / AGENTS.md — undici dependency + proxy behavior, any structure changes.

Why

AGENTS.md's docs rule: new commands, dependencies, and architectural patterns must land in the READMEs. PR #1510 added a good standalone doc but left the per-client READMEs untouched — this issue closes that gap for everything in the decomposition.

Reference implementation (PR #1510)

• docs/mcp-app-review.md — the recipe document (+187)
• AGENTS.md diff — deep-link note

Depends on

Everything else in the decomposition — this lands last, documenting whatever subset shipped.

Notes

• Keep the recipe honest: only document flags/params that actually merged; adjust section numbers accordingly.

Part of the PR #1510 decomposition (see tracking issue).

[cliffhall]

Implemented and reviewed to LGTM on its branch, then consolidated into the Wave 4 rollup #1676 (tracking #1675). Closing as done; the board card moves to Done. The change ships to v2/main when the rollup merges.