feat: connect Knotree Registry account once (backend)

[vantanminh]

Summary

Backend for Vercel-style deploys from Knotree Registry. The user connects their Registry account once. After that they can only list and deploy images from their own namespace, and auto-deploys are tied to their Knotree Accounts identity.

Depends on vantanminh/knotree-registry#4.

• Migration 0022: adds knotree_registry_accounts (one active row per user), registry_account_consent_attempts, and knotree_registry_connections.account_id.
• registry_accounts.rs:
  • POST /integrations/knotree-registry/authorize: namespace consent. It is SSO-subject bound and reuses the PKCE/session-bound callback.
  • GET / DELETE /integrations/knotree-registry: connection status and disconnect. Disconnecting revokes derived connections and turns off auto-deploy.
  • GET /integrations/knotree-registry/repositories[/{repo}]: the image picker. It only ever uses the signed-in user's own credential and filters results to their namespace.
  • POST .../registry-connections/from-account: creates or reuses a project connection, which the existing app-service flow then uses.
• load_credentials: account-derived connections always use the account's live credential, so reconnecting renews every project. PAT rotation is blocked on derived connections.
• Webhook: an account-derived service deploys only when owner_issuer/owner_subject match the connected account. The connection repository must also match the pushed repository.

Not in this PR: the web UI (Integrations page and Import wizard).

Test plan

• Unit tests pass locally (cargo test registry). DB-backed tests were skipped because there was no local Postgres.
• CI with Postgres (checks the migration and SQL)

🤖 Generated with Claude Code