Transfer connector ownership

Changes the connector's owner. Every existing grant is left exactly as it was, so nobody who could already reach it loses that reach; the new owner gains only what ownership itself confers (implicit edit, plus delete and transfer). The previous owner held no grant row, so they are left at use in the same call (unless they already reach use or edit another way) — otherwise every connection they made through the connector would be blocked as connector_not_shared the moment they gave it away. The new owner can revoke that grant like any other; member offboarding is the exception and leaves a departing owner nothing. The target must be an active member of the organization. Allowed for the current owner only — no connector:manage fallback, and an ownerless connector has nobody who may transfer it (403; use POST /connector/{slug}/owner). A transfer that races another transfer (or the owner's removal from the org, which deletes the owner row) answers 409 rather than taking the connector back. Recorded in the audit log as connector.transferred. The 200 is the connector as the CALLER now sees it, so a previous owner (now a use grantee) gets no owner_user_id, no shares and no manage capabilities back. The audit row carries previous_owner_kept_use.