feat: global connection pointers

[beubax]

Description

Adds global provider connection fallbacks. Admins can mark one of their own connections as global per provider, and identities without a local default connection can use that global pointer without copying credentials. Local user connections continue to override globals.

Also adds CLI/API/UI support for managing and displaying global connections with non-admin detail access restricted.

Motivation and Context

This lets deployments configure shared provider connections while preserving each user’s ability to keep or create their own provider-specific connection.

How Has This Been Tested?

Ran:

• uv run pytest
• uv run ruff check src/ tests/
• uv run ty check src/
• uv run pre-commit run --all-files

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• I have read the CONTRIBUTING document.
• All new and existing tests passed.