Connect the firm's practice system, step 1: the credentials (billing, admin)

The credentials are VERIFIED before anything is stored: the adapter connects and probes, and a failure is a 422 whose one error's path names the step that failed (step.tls, step.login, step.schema, step.rights) so an administrator is sent to the one screen in their own system where the answer is. On success the row is sealed under the firm's key, a NEW connector is stored as pending_mapping, the system's employees are written to the team table, and the answer carries the team proposal, matched to the firm's members by exact email and by nothing else (D-166). The adapter's declared pick-list fields are bound in the same step: one attribute per field, source: connector, keyed <kind>_<field> or by the standard it names, created or rebound to the row a former connection of the same system left behind, and a firm-wide field's one set with it (D-174). A connector of ANOTHER kind is a 409 naming Disconnect; the same kind again re-verifies, re-seals, keeps the team and its bindings and keeps a firm that was connected or needs_reconnect connected, because a firm that has already confirmed its team is not sent through that step again by a reconnection. The deliveries a former connection left keep the kind they were sent to, as history. For a kind each member signs in to with their own account (capabilities.identity is sign_in) the caller must be an ADMINISTRATOR (403 for billing) and the credentials are their OWN account (a username and password, or an api_token they made in the system): the firm's row seals which installation it is and no session, the connector is connected at once, the administrator's own session is stored as PUT /v1/connector/account stores a member's, and team is null. It answers as soon as the system accepted the sign-in and runs NO sync: the summary's counts are what the firm held before, and the client sends POST /v1/connector/sync itself, straight after, reading GET /v1/connector/sync/progress while it runs. The same installation again is that administrator signing in again; another installation while connected is a 409 naming Disconnect. An account of the system that another member already signed in with is a 409. An operator is refused such a connect with a 422: it takes a person's own password. A credential whose host resolves to a loopback, private, link-local or unspecified address is a 422 on the path host, before anything is dialled. The system's narrative ceiling is not copied into the firm's settings: the limit in force is the firm's own length under the ceiling, computed on every read.