Connections carry who signed in

[czpython]

A connection row now says who it is. The service declares the provider
endpoint that returns the signed-in account's facts:

class Acme(Service):
    ...
    identity_endpoint = "https://acme.example/oauth/userinfo"
    identity_scopes = ("openid", "email")

Some providers have no such endpoint, or return the facts in a different
shape. They override get_identity(access_token) instead. Only the
platform calls it.

How it lands

• oauth_connections.identity — a JSONB facts dict (email, username,
  name). The callback fills it once at consent with the fresh access
  token. Any failure leaves the connection unlabeled; the consent never
  fails, and a reconsent that gets no answer keeps the identity it had.
• identity_scopes join the consent ask visibly.
• MCP connections get the same fill when the discovered
  authorization-server metadata advertises a userinfo_endpoint.
• The service card and the Connections page label each row with
  email / username / login / name, falling back to the consent
  date and scopes as before.