fix(oauth): isolate Kiro imports and preserve social polling

[AgnesRiber]

Summary

• Manual Kiro refresh-token imports now create independent provider connections instead of overwriting an existing account.
• Kiro social OAuth polling remains pending while authorization is incomplete, instead of terminating on an empty successful response.
• Existing deduplication remains unchanged for other providers and Amazon Q.
• No SQLite schema or migration changes were added.

Related Issues

• Closes fix(backend): Kiro import token endpoint overwrites existing connection instead of creating new one #9435
• Related to [Feature] Kiro multi-account support: independent OAuth sessions per connection #2328

Validation

• Change type: provider / UI / DB
• Focused tests and category gates from the golden path
• npm run lint — global result remains 196 errors and 5 warnings; the scoped Kiro result is only the pre-existing KiroAuthModal.tsx:40 error outside the changed block.
• Reconciled with the current active release base (3022df5); focused checks rerun afterward.
• Production-code changes include new or updated automated tests in this PR.
• SonarQube PR analysis — pending CI.
• Production build passed in the combined validation with fix(docs): add required MDX frontmatter to AGENTROUTER_WAF.md #9503: 663/663 static pages generated.

Tests Added Or Updated

• tests/unit/db-providers-crud.test.ts
• tests/unit/kiro-auto-import-idc-2059.test.ts
• tests/unit/kiro-builder-id-import-3333.test.ts
• tests/unit/kiro-social-poll.test.ts
• tests/unit/kiro-sso-cache-direct-clientid-1253.test.ts
• tests/unit/shared/components/KiroAuthModal.test.tsx
• tests/unit/kiro-import-append-only.test.ts
• tests/unit/kiro-import-route-append-only.test.ts
• tests/unit/kiro-social-exchange-route.test.ts

Focused results: 59/59 Node tests passed, 5/5 KiroAuthModal UI tests passed, npm run typecheck:core passed, and Prettier plus git diff --check passed.

Coverage Notes

• Import route and persistence tests cover distinct connection IDs, encrypted credentials, default deduplication, and Amazon Q compatibility.
• Social polling and route tests cover empty successful responses, pending markers, denial, expiration, slow-down, and successful token responses.
• UI tests cover the manual import payload and same-origin session forwarding.
• No coverage decrease was identified in the focused loop; the full 60% coverage gate remains a CI responsibility.

Reviewer Notes

• Append-only persistence is explicit: only manual Kiro token import disables deduplication; other providers and Amazon Q keep their existing behavior.
• Empty successful social-poll responses and explicit pending markers remain retryable; denial, expiration, and non-success responses remain terminal.
• Manual import preserves the same-origin dashboard session and returns the newly created connection ID.
• Builder-ID, IDC, External IdP, auto-import, API-key, executor, routing, quota, and combo behavior were not changed.
• No real credentials or tokens are included; tests use synthetic data and temporary SQLite databases.
• No schema migration or feature flag is required.

[mergify]

⚠️ The sha of the head commit of this PR conflicts with #8875. Mergify cannot evaluate rules on this PR. Once #8875 is merged or closed, Mergify will resume processing this PR. ⚠️