Fix External MCP server bugs; add npx/Node.js detection and install help

Root-caused two real issues Rune hit with Obsidian/Homepage external MCP
servers:

1. Toggling a server's enable switch silently wiped transportKind/env/
   url/bearerToken/headers back to stdio defaults (only id/name/command/
   args/isEnabled/timeout/createdAt were preserved) — almost certainly
   how Obsidian's config got corrupted into an empty-command stdio entry
   despite never being edited directly. Fixed via
   ExternalMCPServer.withEnabledToggled(), which flips only isEnabled.

2. npx (installed via Homebrew) was invisible to Confab because GUI apps
   only inherit launchd's minimal PATH, not the Terminal PATH. Tried
   spawning the user's login shell to ask for its real PATH — this
   caused two real hangs in one session (first an -ilc pipe deadlock,
   then a waitUntilExit()/CFRunLoop reentrancy issue even after fixing
   that) and was abandoned entirely in favor of LoginShellEnvironment:
   deterministic, subprocess-free directory probing (Homebrew, MacPorts,
   Volta, nvm's alias file) that can't hang by construction.

Also added:
- Edit capability for existing External MCP servers (previously only
  Add/Toggle/Delete) — the second thing Rune explicitly asked for, and
  the way to fix a corrupted entry like Obsidian's without deleting it.
- MCPClientError.commandNotFound: a stdio server's command is checked
  against PATH up front in StdioMCPTransport.prepare() and fails
  immediately with a clear reason instead of cycling through 3 rounds of
  crash/restart backoff (5s/15s/30s) for a permanently-missing binary.
- A "Get Node.js" button appears when this happens, opening a sheet with
  a copyable `brew install node`, a one-click install (via
  NodeInstallHelper, using the terminationHandler/readabilityHandler
  pattern already proven safe elsewhere in this file — deliberately not
  waitUntilExit()), or a nodejs.org link if Homebrew isn't present.
- ExternalMCPManager.retryClient(id:) to manually retry after fixing the
  underlying cause.
- Help book: new "Servers That Use npx" section, updated Server Status
  section, updated Settings blurb.

37 new/changed tests covering the toggle fix, PATH probing, the
commandNotFound fast-fail path, and missing-command detection — full
suite (374 tests) passes clean.

oAI/Services/ExternalMCPClient.swift

@@ -71,14 +71,24 @@ final class ExternalMCPClient {
             let toolsResult: MCPToolsListResult = try await timedRequest(seconds: 15, method: "tools/list", params: nil)
             discoveredTools = toolsResult.tools
         } catch {
-            // Uniformly route every start() failure (bad config, launch failure, handshake
+            transport.stop()
+            if case MCPClientError.commandNotFound = error {
+                // Deliberate exception to the uniform-.crashed rule below: a missing command is a
+                // permanent, static condition — no restart-with-backoff will ever fix a binary that
+                // isn't there, so skip straight to a clear .error instead of 3 rounds of pointless
+                // 5s/15s/30s backoff (which is what used to happen, and is why this exists).
+                let newState: MCPClientState = .error(error.localizedDescription)
+                state = newState
+                stateDelegate?.clientDidChangeState(id: server.id, state: newState)
+                throw error
+            }
+            // Uniformly route every other start() failure (bad config, launch failure, handshake
             // failure — for either transport) through .crashed, not .error, so
             // ExternalMCPManager's restart-with-backoff drives from exactly one place.
             // (Previously, stdio relied on the subprocess's termination handler firing
             // asynchronously to reach .crashed; that path doesn't exist for HTTP, so failures
             // there would otherwise get stuck at .error with no retry.)
             state = .crashed
-            transport.stop()
             stateDelegate?.clientDidChangeState(id: server.id, state: .crashed)
             throw error
         }