Begin connecting a mailbox via the hosted-auth flow

Initiate a mailbox-connect flow.

agent_id / team_id are captured in the OAuth state so the callback can bind the grant atomically. Both optional — callers can bind later via the binding endpoint — but at most one may be set on a single request (a mailbox binds to either a single agent or a team).

Revision pins (agent_revision_id / team_revision_id) are OPTIONAL: omitting one pins the target's current active revision at bind (pin-at-bind), a non-null value pins that exact revision. Each may only be set alongside its own agent/team id.

Returns the URL the frontend should redirect / popup the user to.