Summary

Phase 1 of #512 establishes one authoritative connection lifecycle before the
application-shell suspension work begins.

• add a pure seven-state lifecycle reducer and accessible presentation projector
• assign credential epochs on install/invalidation and fence stale async settlement
• make OAuth refresh single-flight per epoch, with late-finally protection
• preserve credentials as offline when IdP transport/config is unavailable
• report ClickHouse 2xx as connected and rejected non-abort fetch as offline
• keep HTTP/query failures separate from transport state
• drive the header chip reactively from ConnectionSession, never serverVersion
• retain the current full-login auth-loss UX for now; Phase 2 replaces that
  teardown with in-shell suspension and absorbs onAuthLost bypasses mandatory authenticated-session teardown #502/Basic-mode teardown requests (KILL QUERY/export-cancel) get the wrong Authorization scheme after credentials clear #520

Review notes

The architecture review found and this branch fixes:

• racing Basic probes overwriting a newer successful login
• stale OAuth preparation redirecting after a newer credential flow
• stale auth-loss settlement clearing a replacement credential epoch
• transport evidence arriving while token refresh is still in flight
• narrow-screen CSS hiding the authoritative connection state

The architecture gate now mechanically rejects serverVersion readiness
inference in lifecycle/transport/header authority modules and makes
connection-chip projection exclusive to the lifecycle projector/header. The
mounted DOM contract covers all seven lifecycle states.

The lifecycle and execution boundary are deliberately separate. This PR does
not yet preserve the mounted workbench after auth loss; that is the next phase.

Verification

• npm test — 188 files, 6,175 tests; 100% statements/lines
• npm run check:arch
• npm run check:types
• npm run build

Part of #512