fix(security): address review on elicitation credential flow

[SavioBS629]

Summary

Follow-up to #361 (credential elicitation for createAccessibilityAuthConfig and createLCASteps), addressing review findings on the elicitation flow.

Changes

• Instrumentation gap — createAccessibilityAuthConfig now fires trackMCP on the missing-credentials return path (previously untracked when the user declines or the client can't elicit), and the handler is wrapped in try/catch so a getClientCapabilities() failure routes through handleMCPError instead of throwing raw.
• Silent failure in createLCASteps — when requires_authentication is set but no credentials could be obtained (client can't elicit or the user declines), the tool now returns a clear error instead of silently creating a login test case with credentials: undefined. This mirrors the accessibility tool's behavior.
• Log-leak hardening — the elicitation fallback no longer logs the raw error (a client validation error can echo the submitted password); it logs a static warn instead.
• Types — the elicitation result is typed as ElicitResult.
• Context budget — trimmed the new .describe() strings back within the tool-prompt budget.

Testing

• npm run build (lint + format + tests + tsc) — green (273 tests).
• Updated the createLCASteps test that had codified the silent behavior to assert the new error, and added a backward-compat test (credentials passed as args with requires_authentication set).

🤖 Generated with Claude Code