On-demand resource listing for tree navigation in the picker.

The proposal's initial resource_cache only holds root-level items (the agent doesn't pre-recurse into folders). When the user clicks into a folder in the picker, the iframe calls this endpoint with the parent's resource_id and we proxy through to the existing list_source_resources route handler — the same one the platform's SourceScopePicker.tsx uses for Drive/Granola navigation.

Auth: HMAC signature on the proposal_id (same scheme as the other iframe endpoints). The proposal row carries the original user_id we set at creation, which we synthesize into the list_source_resources call so the Composio/Granola permissions match the user who owns the proposal.