feat: Registry integration UI and grant_revoked handling

[vantanminh]

Summary

• Integrations page: new Knotree Registry card. Users can connect once through SSO-bound consent, reconnect after expiry, and disconnect.
• Deploy dialog: when you choose Knotree Registry with a connected account, a searchable list of your own namespace's images and a tag dropdown appear. The repository is linked through registry-connections/from-account, and no token is needed. The per-repository token flow is still available for other repositories.
• Webhook: grant_revoked from Registry revokes the matching account, but only when the reported owner matches it. It also revokes any matching legacy connection, turns off auto-deploy, fails pending jobs and removes pull secrets.
• Consent now returns to /settings/integrations by default. The old default was /integrations, which is not a web route.
• Harness: DEC-0011 recorded and US-048 marked implemented.

Test plan

• cargo test for the API against Postgres 16 locally: 118 passed, including the new revocation test.
• pnpm --dir apps/web build
• Web tests: the new account-import dialog test and the Registry integration card test pass. Locally the existing AuthPage topology test times out at 5s, and it does so on main as well.

🤖 Generated with Claude Code