fix(server): let a custom MCP server name its token header (fixes #817)

app/src/lib/plugins/mutations.ts

@@ -47,6 +47,11 @@ export type CustomServerInput = {
   url: string;
   token?: string;
   credentialId?: string;
+  /**
+   * The header the deployment token travels in, when it is not `Authorization`. Absent
+   * leaves a stored header alone; an empty string clears it back to the default.
+   */
+  tokenHeader?: string;
 };
 
 /** Which kinds of plugin a grant can be about. */

app/src/lib/plugins/queries.ts

@@ -70,6 +70,12 @@ export type PluginServer = {
   docsUrl: string;
   /** `first-party` for a reviewed entry, `custom` for one an administrator added by URL. */
   provenance: string;
+  /**
+   * The header this server's deployment token travels in, when it is not `Authorization`.
+   * Only a custom server ever carries one; null means the default. Optional because a server
+   * replica older than this field does not send it, mid-rollout.
+   */
+  tokenHeader?: string | null;
   hasCredential: boolean;
   toolsRefreshedAt: string | null;
   lastError: string | null;

server/drizzle/0066_custom_server_token_header.sql

@@ -0,0 +1 @@
+ALTER TABLE "mcp_servers" ADD COLUMN "token_header" text;