Connections own their credentials

Migration 0038 moves every stored secret (OAuth tokens, MCP OAuth
tokens and client registrations, API keys) into the connection's
encrypted envelope, links API-key tools to one connection per distinct
credential, allows several accounts per provider, and adds
credential_mode to sources and tools. OAuth MCP tools keep resolving
each member's own token, as they did before.

docsgpt.connectors.service is now the only reader of OAuth tokens:
get_valid_token_info refreshes under a row lock and persists rotated
refresh tokens, and a revoked grant flags the connection, pauses its
sources and notifies the owner. Loaders build from a connection
(BaseConnectorLoader.from_connection), so scheduled sync covers Drive,
SharePoint and Confluence sources with no browser. S3 and Reddit keys
stay on the connection instead of in remote_data.

New endpoints: POST /api/connections, /setup, /reconnect,
/picker-token, /claim, DELETE /api/connections/<id>, per-action
permissions and MCP refresh-tools. Upload, file listing, sync and
validate-session take a connection_id; session tokens keep working for
this release. The tool executor reads credentials from the resolved
connection (owner or member mode) and pauses on a Connect card when a
connection needs signing in. docsgpt connectors reencrypt rewrites
stored credentials after a key rotation.

tests/api/user/test_tasks.py

@@ -67,7 +67,8 @@ class TestIngestRemoteTask:
 
         mock_worker.assert_called_once_with(
             ANY, {"url": "http://x"}, "job1", "user1", "web",
-            config=None, idempotency_key=None, source_id=None,
+            sync_frequency="never",
+            config=None, idempotency_key=None, source_id=None, connection_id=None,
         )
         assert result == {"status": "ok"}
 
@@ -223,6 +224,7 @@ class TestIngestConnectorTask:
             "user1",
             "gdrive",
             session_token=None,
+            connection_id=None,
             file_ids=None,
             folder_ids=None,
             recursive=True,
@@ -248,6 +250,7 @@ class TestIngestConnectorTask:
             "user1",
             "sharepoint",
             session_token="tok",
+            connection_id=None,
             file_ids=["f1"],
             folder_ids=["d1"],
             recursive=False,
@@ -263,6 +266,7 @@ class TestIngestConnectorTask:
             "user1",
             "sharepoint",
             session_token="tok",
+            connection_id=None,
             file_ids=["f1"],
             folder_ids=["d1"],
             recursive=False,