feat(external-sources): add application connection controls

[limityan]

Summary

This PR adds the first end-to-end External AI Application connection experience:

• introduces strict V2 application snapshots, bounded review pages, and closed control actions while preserving the V1 wire contract;
• keeps runtime ownership in the existing workspace external-source service and preference store;
• exposes the same owner through Desktop, Peer Host, and management-backed Embedded App Server adapters;
• adds a compact Desktop Settings experience and matching interactive TUI commands;
• preserves the existing Hook management path without adding another Hook owner or extension manager.

Product experience

The default screen answers three questions only: which applications were found, whether each one is connected, and what action the user can take.

• Raw technical fields are removed from the default flow. User-visible reasons explain the effect and the next action.
• A single review item has direct Enable and Keep disabled decisions. Multiple items use explicit selection plus Apply, with Keep all disabled as the safe alternative.
• Review identity, revision, owner generations, selection limits, and pagination are rebound to the Host's authoritative first page before interaction.
• Hooks and Advanced settings use standard full-row disclosures with chevrons, hover/focus feedback, and lazy content.
• An empty Hooks section explains that no Hooks are currently available and where BitFun checks for them.
• Application rows keep Host-owned status as the primary fact; degraded health, blocked/conflict counts, and recovery guidance appear only when relevant.
• The TUI follows the same decision model: one-item review allow, multi-item include/exclude plus review apply, and review deny to keep everything disabled.

The UI keeps the existing five application statuses. There is no wizard, modal stack, second state machine, new manager/store, or additional persistent user preference model.

Architecture and compatibility

• bitfun-product-domains owns behavior-light V2 DTOs, validation, and the shared status/action reducer.
• bitfun-core projects V2 state from the existing workspace external-source owner and preference store.
• Desktop and Peer Host bind workspace-scoped requests to the Host's active workspace.
• Embedded App Server supports the management-backed path. General Server /ws and Shared TUI remain explicitly unsupported rather than falling back to controller-local state.
• V2 snapshot probing falls back only to strict V1 read-only presentation for old Hosts. V2 mutation and review requests never downgrade.
• Review pages require an active owner, are bounded, and fail closed on Host/workspace/revision/generation drift.
• Existing preferences migrate conservatively; incompatible schemas fail closed, and a migration write failure retains a valid V1 read path.

Complexity and performance controls

Area	Earlier candidate behavior	Final behavior
Snapshot review summary	Built full review display DTOs	Builds summary metadata only; display DTOs are created only for review pages
Application aggregation	Repeated source/subagent scans	Builds one source and subagent index per snapshot
Review pagination	Bounded contract	Remains bounded to 128 items per Host page
UI state	V1 catalog plus Host V2 application facts	One fenced controller; V1 is retained only for legacy Advanced/Hook content and old-Host read-only fallback

No latency claim is made; these are allocation and lookup-path constraints verified in code and focused tests.

Verification

Latest focused verification after rebasing onto GCWing/main:

• Web UI: 6 focused files, 141 tests passed
• pnpm run type-check:web
• focused Web UI ESLint
• pnpm --dir src/web-ui build
• pnpm run verify:monaco-assets
• Core application_review_: 2 tests passed
• CLI/TUI external_: 72 unit tests and 1 terminal integration passed
• pnpm run i18n:audit
• pnpm run appearance:contract-audit
• pnpm run theme:color-audit:all
• git diff --check
• independent read-only adversarial review: no remaining actionable P0-P2 findings

The V2 product-domain, App Server protocol/client, Desktop command, Peer Host, and boundary suites were also completed during the PR implementation. Known local warnings are pre-existing dead-code/import, chunk-size, and MSVC linker warnings.

Non-goals

• task-scoped dependency-action events and non-interactive CLI outcomes remain follow-up work;
• Shared Runtime V2 and general Server workspace-owner injection are not claimed;
• no generic importer/runtime, cross-owner transaction manager, rollback engine, global workspace registry, or capability directory is introduced.

Reviewer focus

Please focus review on preference migration, Host/workspace identity, strict V1/V2 negotiation, authoritative review rebinding, and partial batch outcomes.