Create connection

Creates a pending connection and returns a connect_url for the user to open. Authentication happens with the provider, never through this API, so no credential is ever sent here. Poll GET /connection/{id} until the status is active. The caller becomes owner_user_id. Optional shares grants access at creation time: absent or [] makes a private connection, reachable only by its owner, and needs only connection:create; any non-empty shares additionally needs connection:share, because a shared connection hands its account to other members the instant it is created. Connecting through an org-owned connector nobody shared with the caller answers 403 connector_not_shared (read can_use on the connector row to know in advance); a connector an admin restriction blocks is a different 403, flagged restricted on the connector. A connector that needs the organization's own OAuth app (byoa: true), has none added yet and offers no API-key option answers 409 oauth_app_required before anything is written, so no pending connection is left behind. details carries connector_slug, can_configure_oauth_app and setup_path (/connectors/{slug}, the connector page where the app is added; null when the caller may not add one, so tell them to ask an admin). Read connect_blocked on GET /connector/{slug} to know in advance.