Update developer setup page

Signed-off-by: Mihai Criveti <crivetimihai@gmail.com>

Update developer setup page

Update developer setup page
Signed-off-by: Vicky Kuo <vicky.kuo@ibm.com>

Merged IBM/mcp-context-forge upstream/main into feature/upstream-sync-march30.

Key upstream additions:
- Security: Server ID validation in Streamable HTTP, secrets detection,
  content size limits, service account support
- SSO: Stale team membership revocation, groups claim extraction for
  generic OIDC providers, sync_roles flag
- RBAC: Session-token team narrowing Layer 2, permission-based menu hiding
- Observability: Fix duplicate DB session middleware, metrics returning 0
  after cleanup, metrics_cache leak fix
- Tools: Configurable forbidden description patterns (replaces our IBM#18)
- Plugins: retry-with-backoff, PII filter Rust hardening, URL reputation
- Infra: Remove MySQL/MongoDB support (PostgreSQL only), rate limiter fix
- A2A: Cascade agent state changes to MCP tools
- UI: Persist admin table filters, team member modal fixes

Conflicts resolved (10 files):
- admin.py: kept upstream team preservation on edit + our OIDC sync params
- schemas.py: kept upstream configurable patterns + our meta-server fields
- gateway_service.py: kept upstream visibility propagation fix
- oauth_manager.py: kept our expires_in=None fix (patch IBM#20)
- sso_service.py: adopted upstream _build_normalized_user_info refactor
- team_management_service.py: kept our PermissionError + upstream UNSET/skip_limits
- streamablehttp_transport.py: adapted meta-server loading to use validated server_id
- sso_bootstrap.py: combined upstream scope preservation + our smart team_mapping merge
- test_sso_*.py: adopted upstream test refactoring

Patches now obsolete (superseded by upstream):
- IBM#1 (SSO email_verified) — upstream b668d2b
- IBM#8 (teams=None) — upstream b2b6c12
- IBM#18 (tool description sanitize) — upstream bd803e5 (configurable patterns)