Validate Source Connection

Pre-save connection test for an API-source connector (the form's "Test connection" button).

Runs the vendor's credential probe plus per-resource access checks against the SUBMITTED config — nothing is persisted; the secret travels in the request body only. 200 always carries the structured result (a failed test is a result, not an HTTP error): credential_ok + message (+ field, the config field a rejected credential is fixed on) for the token, per-resource ok/message for scope gaps (+ needs, what the resource lacks, and fix, a remedy shared verbatim by every resource it fixes, when the refusal is a missing permission, scope or product), account_in_use (+ the clashing source's existing_source_id) when the vendor account already backs another source in this workspace (the save would 409). HTTP errors mean the test could not run: 404 unknown connector, 400 unsupported vendor / masked secret without source_id / malformed config, 403 without source_id when the connector is not available on this deployment (the contract's unavailable_reason), 502 vendor outage. The schema contract's capabilities field declares whether a connector supports this at all. On the edit form, pass source_id so a masked secret resolves to the stored credential.