Record Connect Attempt

Body of the unauthenticated POST /v1/auth/oauth/connect-attempts (Q-2381).

Sent by the keel-app SERVER render of the connect flow, best-effort. It carries only facts the page already holds. device_class is the page's reduction of the request's user agent: the raw user agent and the IP are never sent and never stored, and extra="forbid" turns any attempt to send them into a 422 rather than a silently dropped field.

Monotonic by construction: a later call with the same attempt_id can only STAMP consent_shown_at once and record a first cancelled decision. It can never set a principal or an approved decision; only the authenticated authorize-complete does that.

200 body of POST /v1/auth/oauth/connect-attempts (connect-onboarding spec 01 §1.3).

experiment_arm is the arm STORED on the attempt row -- written once, on the first INSERT, from WELCOME_BONUS_PCT -- so a replay reports the original assignment. null when the row predates the arm, or on any internal failure (the endpoint is best-effort and still answers 200). keel-app treats null, a non-200 or a network error alike as "no bonus line".