Begin connecting an account

For a connector that runs as a connected account: the provider’s consent URL (authorization code + PKCE, the connector’s scopes, a signed state) to open in a popup. The provider returns the browser to the public callback, which keeps the grant and posts { type: "brain-source-oauth", grantId, account } to the origin named here. Connected accounts (docs/source-plane.md § Connected accounts): the brain as an outbound OAuth 2.1 client for the cloud connectors (gdrive, onedrive, dropbox). Answers a bare 404 until SOURCE_PLANE_ENABLED=1 and SOURCE_OAUTH_CLIENT=1; needs SOURCE_CREDENTIAL_ENCRYPTION_KEY — tokens are never stored in the clear.

Required scope: brain:admin.