[ppXD]

Summary

• A credential's owner can reconnect it themselves. POST /api/credentials/oauth/init naming a replaceCredentialId passes the credential's own person on membership alone (a Member or Viewer whose sign-in died brings it back in place, in the starting browser and across sites through the SPA's completion page); anyone else still needs credentials.manage, and a connect that names no credential keeps its bar. The same-account rule, retired and departed refusals and the named-owner check are unchanged.
• One definition of who may repair a credential, so a button is shown exactly when the request would be accepted. A reconnect signs in as the person, so it also keeps the reach over them: an Admin cannot reconnect another Admin's or an Owner's sign-in, and nobody can for someone who has left the team (a pasted token has no rank reach, but also cannot be replaced for someone who left). The pipeline, the OAuth callback's re-check (starter removed, demoted, or the person promoted past them before the code is exchanged), the run-detail remedy, and the new callerMayRepair on GET /api/credentials, which the repository rows read, all ask the same rule over the person's role as TeamStanding.RolesActedOnAsync reads it (TeamMemberService uses it too). The remedy's reasons and "who to ask" now name only people who could do what the caller cannot.
• Compatible: callerMayRepair is an additive nullable field (an older SPA ignores it, a newer SPA falls back to the role when a server sends none); no migration, setting or change to any endpoint's request or status.

Test plan

• Unit: PermitsReconnect table, CredentialPerson, CallerStanding and the remedy's wording and ordering per role, person and departed owner
• Integration: 48-case agreement matrix (asker role x own/other person's role/left x sign-in/pasted token) where the remedy button, callerMayRepair and the real command (accepted only if it returns) must agree
• Integration: callback refuses a starter removed from the team, demoted, or outranked by a promotion, through both completion doors, never exchanging the code; RoleHeldAsync agrees with the resolver in a deleted team; reach agreement for every kind of person
• HTTP E2E: reach matrix with the list flag, departed owner 404, plus the existing owner-reconnect and cross-site SPA completion cases via GitLabDoorkeeperStub
• Frontend: vitest for the repository row (server flag beats the role, fallback without it) and the remedy card; pnpm lint, tsc --noEmit, full vitest, build
• Regression: full unit suite (14763), credential/OAuth/teams/tenancy/authorization/binding integration lanes (701), credentials/auth/teams/repositories/webhooks HTTP E2E lanes (272), dotnet build CodeSpace.sln