[feature] Resource Visibility & Sharing (connections, projects, agents) & Connection Reassignment

## Summary

Introduce a resource-agnostic **Resource Visibility & Sharing** model and wire connections, projects and agents to it, together with the connection lifecycle around it (status tracking, user-removal reassignment, workflow execution guards, credential replacement).

## Capabilities

**Resource visibility framework**
- `ResourceVisibility` (`PRIVATE < WORKSPACE < ORGANIZATION`, `platform-api`, ordinals pinned by `ResourceVisibilityTest`)
- `ResourceVisibilityPolicy` per resource type — which rungs it supports and which one it is created with (WORKSPACE by default)
- "Specific people" = `PRIVATE` + rows in the polymorphic `resource_grant` table (EE, `platform-resource-grant`); grants convey visibility only, deleted with the resource
- Visibility is a **precondition** of `hasResourceScope`, both `hasWorkspaceScopeForProject` overloads and `hasWorkflowScope` (CE and EE)

**Connections**
- PRIVATE / PROJECT / WORKSPACE / ORGANIZATION visibility levels
- Permission enforcement per scope
- Environment validation
- Organization connections (created through the shared `ConnectionDialog`)
- Wholesale replacement of a connection's authorization parameters, owner or admin only (workspace connection facade + embedded reconnect)

**Projects**
- `project.visibility` column (`PRIVATE` / `WORKSPACE`, `ProjectVisibilityPolicy`), a precondition of every project-keyed check
- Workflows, project workflows, deployments and jobs inherit the project's reach (grants resolve against `("Project", projectId)`)
- EE project sharing facade; copilot, AI-eval and playground workspace gates moved onto facades
- Design + endpoint audit: `docs/superpowers/specs/2026-08-17-project-visibility-design.md`

**Agents**
- Dedicated agent permission scopes, visibility and sharing
- Agent reach shown and editable on the agent list and detail page

**Connection lifecycle**
- `ConnectionStatus` (ACTIVE / PENDING_REASSIGNMENT / REVOKED)
- `validateConnectionsActive` — blocks user- and trigger-initiated workflow runs on non-ACTIVE connections
- `WORKFLOW_PAUSED` audit event on block
- `WorkspaceUserRemovedEvent` + listener marks removed user's connections `PENDING_REASSIGNMENT` post-commit
- `removeWorkspaceUser` GraphQL mutation

**UI**
- Connection picker grouped by visibility scope with `ConnectionScopeBadge`
- Organization connections management in Settings
- Reassignment flows
- Generalized visibility picker (connections, projects, agents)
- Replace credentials of an existing connection

## Out of scope

- AI Hub chat visibility (`AiHubChatVisibilityPolicy`, created `PRIVATE`) builds on this framework but is tracked separately.

## Acceptance Criteria

- [ ] Design spec and gap-remediation plan reviewed
- [ ] Liquibase migrations applied cleanly
- [ ] All four connection visibility scopes functional with permission enforcement
- [ ] Workflow execution blocks on non-ACTIVE connections (both paths: user-initiated + trigger)
- [ ] User removal triggers reassignment state transition
- [ ] Connection picker renders grouped by scope with badges
- [ ] Project visibility enforced on every project-keyed permission check (incl. inherited workflow/deployment/job checks)
- [ ] Project and agent sharing via `resource_grant` functional; grants removed on resource delete
- [ ] Connection credential replacement restricted to owner or admin
- [ ] EE edition gating verified where applicable