[ppXD]

Summary

• The Providers dialog no longer piles up history. A disconnected credential that nothing leans on (no repositories, in-service group hooks or act-as identities) folds into one "N earlier connections - disconnected" line. The line expands to rows with Remove, and for a sign-in also Reconnect. Reconnect re-authorizes in place and takes only membership, so a Member who cannot start a plain "Connect with OAuth" can still get back to a working connection.
• A dead or refused credential that still holds repositories or group hooks says what holds it ("2 repositories and 1 group hook still use it"). It leads with Move them to (the existing relink-bindings command), with Reconnect / Replace token second. The target is the first YourConnection the relink-suggestions endpoint returns and is never filtered by instance on the client, so the server-side same-host widening applies as soon as it ships.
• Every row says "authorized X ago" (the provider's last confirmation), with the connected date in the tooltip. A working sign-in's Reconnect moves into the row menu as Re-authorize. A landed Reconnect or Replace token confirms in the row ("Reconnected - GitLab authorized just now"). The note is cleared when the credential is later disconnected or revoked, or its token is replaced again. A refused reconnect shows the callback's own sentence.
• Server: DELETE /api/credentials/{id} (RemoveDisconnectedCredentialCommand) soft-deletes a disconnected credential nothing leans on. The owner needs only membership; anyone else needs credentials.manage. It refuses a live row, a row with dependents, and one a reconnect revived mid-removal (compare-and-swap write). A refused Remove re-reads the list, so a row that changed under the person stops reading as history.
• GET /api/credentials gains additive dependentCount, boundConnectionWebhookCount and actAsIdentityCount. An older server that sends none keeps the old unfolded list with no Remove.

Test plan

• Unit: CredentialRemoval refusal rule; credentialHealth (isHistory, canMoveBindingsOff including hook-only and identity-only, dependentsLabel combinations)
• Integration (real Postgres): Remove refusals (live row, row with dependents, someone else's without credentials.manage, reconnect mid-removal); the list's per-kind counts equal the dependents read
• E2E (HTTP): revoke, list and DELETE through the real pipeline; the list keeps every field an older client reads and adds the new counts
• Frontend: fold and expand, Remove, Reconnect from the fold (Member, Admin, token, provider with no OAuth app), the move-them primary action (own connection only, never a team token, per-credential suggestions, re-read after a move, hook-only), authorized time, the Re-authorize overflow, confirmations cleared on disconnect or replace, a refused Remove refreshes the list, and an older server (no new fields) still renders
• Frontend suite 2791/2791, pnpm lint 0 errors, tsc --noEmit, pnpm build
• Staging: with a Member account holding one disconnected OAuth credential, open the fold and Reconnect; confirm the row returns as a working connection