[feature] Connection Visibility & Reassignment

[ivicac]

Summary

Introduce Connection Visibility — scope connections as PRIVATE / PROJECT / WORKSPACE / ORGANIZATION — and the lifecycle around it (status tracking, user-removal reassignment, workflow execution guards).

Capabilities

Scoping

• PRIVATE / PROJECT / WORKSPACE / ORGANIZATION visibility levels
• Permission enforcement per scope
• Environment validation

Lifecycle

• ConnectionStatus (ACTIVE / PENDING_REASSIGNMENT / REVOKED)
• validateConnectionsActive — blocks user- and trigger-initiated workflow runs on non-ACTIVE connections
• WORKFLOW_PAUSED audit event on block
• WorkspaceUserRemovedEvent + listener marks removed user's connections PENDING_REASSIGNMENT post-commit
• removeWorkspaceUser GraphQL mutation

UI

• Connection picker grouped by visibility scope with ConnectionScopeBadge
• Organization connections management in Settings
• Reassignment flows

Acceptance Criteria

• Design spec and gap-remediation plan reviewed
• Liquibase migrations applied cleanly
• All four visibility scopes functional with permission enforcement
• Workflow execution blocks on non-ACTIVE connections (both paths: user-initiated + trigger)
• User removal triggers reassignment state transition
• Connection picker renders grouped by scope with badges
• EE edition gating verified where applicable