Public source connector catalog

Honest per-connector state without credential values. Unauthenticated. Makes no outbound vendor call; it does ask the orchestrator for its own non-secret source status, because that is the Worker a licensed fetch would run on. The licensed-article row also carries licensing: the publisher domains an operator has verified and every cap a licensed read runs under — per article, per run, per run in articles, per UTC day, per month and the shared aggregate.