Add delegated connection subjects

[mukul-anand-bhatt]

Summary

• add an optional machine-only delegation credential so a trusted gateway can bind REST and MCP requests to a verified member subject
• record the authenticated connector on both workspace and personal connections, including schema migrations and API responses
• prove workspace sharing and same-organization personal isolation, while preventing ordinary member or admin API keys from impersonating another subject

Security model

The delegation credential is separate from user and admin API keys. A matched delegation credential must include a valid account ID and current organization role or authentication fails closed. Existing authentication behavior is unchanged when delegation is not configured.

connectedBy is attribution only. Workspace ownership remains shared, and changing a connection to personal ownership still requires an explicit authorized operation.

Testing

• bun run format:check
• bun run lint
• bun run typecheck
• TURBO_TEST_CONCURRENCY=4 bun run test
• bun run --filter @executor-js/sdk test
• bun run --filter @executor-js/host-selfhost build