Composio: connecting managed-OAuth toolkits fails with 400 — use POST /connected_accounts/link

## Summary
Connecting any Composio-managed OAuth toolkit (HubSpot, GitHub, etc.) from the desktop app fails with `Composio API error: 400 Bad Request`. No connection is ever established; every toolkit permanently reports "not connected" and no Composio tool can execute.

## Environment
- Rowboat desktop 0.8.9 (Windows 11)
- Composio API key from `config/composio.json`

## Root cause
`createConnectedAccount` in the composio client (`packages/core/src/composio/client.ts`) POSTs to `/api/v3/connected_accounts` with `{ auth_config: { id }, connection: { user_id, callback_url } }`. Composio has retired that endpoint for Composio-managed OAuth auth configs. Reproduced response from the live API:

```
400 code 600 ConnectedAccount_BadRequest
"Creating connections on this endpoint for Composio-managed OAuth auth configs is no longer supported. Use POST /api/v3/connected_accounts/link instead."
suggested_fix: "Call POST /api/v3/connected_accounts/link with the same auth_config_id and user_id to get a redirect URL for the end user."
```

## Fix (verified against the live API)
Call `POST /api/v3/connected_accounts/link` instead:
- request: `{ auth_config_id, user_id, callback_url }`
- response: `201 { link_token, redirect_url, connected_account_id, expires_at }`

Map the response for downstream consumers: `connected_account_id` → `id`, `redirect_url` → `connectionData.val.redirectUrl` (the connect handler reads `response.id` and `response.connectionData?.val?.redirectUrl`).

The follow-up sync (`GET /connected_accounts/{id}`) works unchanged: the account returns INITIALIZING and flips to ACTIVE once the user completes OAuth.

## Impact
Any connect attempt from the desktop UI fails before the account is created, so the local connection registry (`data/composio/connected_accounts.json`) is never written and all toolkits report disconnected. This blocks all Composio tool execution.

Start in packages/core/src/composio/client.ts at createConnectedAccount and compare its current request with the documented POST /api/v3/connected_accounts/link payload and response. Verify that the returned connected_account_id and redirect_url are exposed through the existing id and connectionData.val.redirectUrl fields, then confirm the follow-up GET sync remains unchanged.

Written by the indexing model from the issue text.