Move repository bindings when a credential is disconnected

[ppXD]

Summary

• Disconnecting a credential now moves the repositories and group hooks bound through it in the same unit of work. RevokeCredentialCommand takes an optional MoveBindingsToCredentialId. Left out, the bindings follow the owner's only other live connection, but only when the owner is the one disconnecting a credential that is still live. An Admin cutting off a teammate's token, a retry of a disconnect already made, a team token, and a choice between two or more connections all move nothing, as before. Connect-then-disconnect now ends where disconnect-then-connect always did. Unlinking a provider identity ends its credential under the same rule. A refused target fails before the provider is asked to revoke anything.
• GET /credentials/{id}/usage previews which outcome a Disconnect will have (willMoveRepositoryCount, willMoveToDisplayName; activeRepositoryCount is the number that would break), and the Disconnect confirm dialog quotes it. The old fields keep their meaning, and an API that predates the fields is read as "nothing moves".
• New RelinkCredentialBindingsCommand (POST /credentials/{id}/relink-bindings) moves everything a dead credential left, a departed member's retired token included, in one action. It needs repos.manage and credentials.manage, accepts only the caller's own connection or a team token on the same provider instance, and asks the target to read every repository first. A repository the target cannot read (401/403/404, insufficient scope, a refused OAuth grant) refuses the whole move and names it. A provider that does not answer (outage, rate limit) is a retryable refusal that blames no one. One relink verifies at most 100 repositories.
• GetCredentialDependentsQuery lists the repositories (with projects), group hooks, act-as identities and workflow triggers that lean on a credential. GetRelinkSuggestionsQuery ranks the caller's own live connections first, then team tokens. For a credential that is still connected it offers exactly the targets a Disconnect accepts (the same owner's other connections).
• The departed-token retirement and the stranded-binding repair run through one shared pass. It reads its backlog in pages behind an id cursor, so candidates that can never succeed no longer hold the whole batch and starve the rest. It is bounded in attempts and candidates examined, and a candidate that fails three passes in a row is set aside for an hour instead of being attempted and warned about every tick.
• The disconnected-repository error and CredentialDisconnectedException name only the remedies a person can perform today. TeamStanding and IRequireCredentialManagement semantics are unchanged.
• Non-breaking: no migration, existing credentials, bindings and runs are untouched, new response fields are additive and optional, a body-less revoke still works, and a rolling deploy or rollback leaves the repair sweep as the fallback.

Test plan

• Integration (real Postgres, real mediator pipeline): connect-then-disconnect, named and implied targets, refused targets, owner-only and live-only implied move, identity unlink, usage preview equals the Disconnect outcome, relink-all with the authorization matrix (including the service-side credentials.manage check), suggestions equal what a Disconnect accepts, dependents filters, probe failure classification, the 100-repository bound, and poison-pill fairness for both sweeps with a real Postgres trigger.
• Unit: sweep pass (cursor, bounds, back-off, cancellation), back-off ledger (threshold, window, forgetting), suggestion ranking, remedy messages.
• E2E over HTTP: disconnect with move then a run clones through the new credential, usage preview vs body-less revoke, Admin default moves nothing, live suggestions, owner leaves then relink-all and hooks revive.
• Frontend (Node 22): lint, tsc --noEmit -p tsconfig.app.json, vitest (273 files), build. The dialog wording tests are red against the old modal.
• Mutation checks on the new guards and filters, each restored by copy.
• After deploy: watch credential-binding-repair and departed-credential-retirement warnings; a candidate should log once, then go quiet for an hour.