List Connections

Every third-party client the caller has a live grant for -- an unrevoked access token OR an unrevoked refresh token. A client that has revoked only its access token still holds a refresh token it can mint new access tokens from at any time, so joining on OAuthAccessToken alone would let it silently disappear from this listing while still live: the user would believe they'd cut it off when they had not. One row per client_id regardless of how many tokens of either kind they're holding for it (access rows take priority when both exist, since that's the more current grant). Scoped to user.id from the verified JWT -- never a client-supplied id -- so this can only ever show the caller's own connections.