Integrations V114: uuid-only storage keys + picker UX + form fixes + C12 sweep

[mdon]

Summary

Quality sweep on the Integrations subsystem and the core
IntegrationPicker / integration_form LV. The architectural change
is V114 — collapsing the per-row phoenix_kit_settings.key
from the composite integration:<provider>:<name> shape to just
the row's uuid. Lifts both name restrictions (regex + uniqueness)
that were storage-layout artifacts, not product decisions: any
non-empty string is now a valid connection name, duplicates within
a provider are allowed.

(V113 was occupied upstream by the Tessera migration. This PR's
migration was originally numbered V113 locally; renumbered to
V114 during rebase per the workspace convention.)

PR follow-up(s)

• 3901bc4c — Triaged BeamLabEU/phoenix_kit#526 (selected-card
  indicator on SortableGrid). Two NITPICKs + one IMPROVEMENT-LOW;
  NITPICK Updated the comments in users_live html file, and added Modules link in dashboard. #2 (!important) was already fixed post-merge in
  3521fa2f; the other two are forward-looking notes deferred to
  the existing component-coverage TODO in AGENTS.md. FOLLOW_UP.md
  in the standard batch-fix format.

Quality sweep

Storage refactor (V114) — 31ab4ad6 (renumbered post-rebase)

• add_connection/3: dropped the [a-zA-Z0-9][a-zA-Z0-9\-_]*
  regex AND the per-provider uniqueness check. UUIDv7 is generated
  up-front and embedded directly in both the row's uuid column
  and the key column.
• rename_connection/3: rewrites only the JSONB name field. No
  more key column rewrite, no uniqueness check, no regex.
• Read sites (get_integration_by_uuid/1, list_connections/1,
  load_all_connections/1) source provider+name from JSONB; the
  list helpers also expose :date_added so UI callers can render
  "Created N ago" without a second lookup.
• provider:name string lookups become first-match semantics
  (names aren't unique anymore). Read-shim contract preserved for
  legacy migrate_legacy/0 callsites.
• log_activity takes explicit (provider, name) so audit rows
  carry human-readable names — parsing the key would have stamped
  a uuid string into metadata.connection.

Migration (V114)

• One UPDATE walks every integration:%-keyed row, backfills
  missing value_json -> 'name' / 'provider', ensures module = 'integrations', and rewrites key = uuid::text. Legacy V0-shape
  keys without a :name segment fold to name = "default".
• down/1 rewrites back to composite shape; collision suffix
  -<8-char uuid> on duplicate (provider, name) pairs (lossy by
  necessity).
• 9 round-trip tests in v114_test.exs covering the up rewrite,
  name backfill, JSONB-name preservation, V0 keyless shape →
  "default", module stamping, non-integration row skip,
  idempotence, and down-side collision suffixing. One real bug
  caught by the test (V0 keyless integration:google was being
  treated as name="google" instead of "default"; fixed via
  split_part SQL).

Form-clear preservation — 28cb0b59

• create_connection + save_form_with_rename error branches
  now preserve :new_name + :form_values (mirroring the
  existing test_credentials_dry_run/2 path). Pre-fix, hitting
  :empty_name on submit wiped the api_key the operator just
  typed.
• Dropped the dead :already_exists / :invalid_name error
  branches (those tuples no longer fire post-V114).
• Template: removed the now-incorrect "Letters, digits, hyphens,
  and underscores. Must be unique per provider." hint and the
  <provider> Connection label.

IntegrationPicker — 4106ce33

• Card subtitle: priority external_account_id → masked
  credential tail (first 8 + … + last 4 for any of api_key /
  bot_token / access_key; ••• for keys under 14 chars).
• Age line under subtitle using shared <.time_ago>.
• Status badge: distinct labels + colours for each of the four
  canonical statuses (connected → green "Connected",
  error → red "Auth failed" with validation_status tooltip,
  configured → yellow "Not tested", disconnected → grey "Not
  connected"). Aligns with the Endpoints list LV's vocabulary.
• Provider icon + display name now auto-resolve via
  Integrations.Providers.get(data["provider"]) — callers no
  longer have to pre-attach a :provider struct. Dead
  is_map(conn[:provider]) / is_binary(conn[:provider_key])
  branches removed.
• Provider-name badge hides when the picker is filtered to a
  single provider (provider attr set) — both real callsites do
  this, making the badge redundant.
• Click feedback: phx-click-loading:opacity-60 +
  phx-click-loading:pointer-events-none dims the clicked card +
  blocks rapid re-clicks during the LV round-trip; daisyUI
  loading-spinner swaps in for the status badge during the
  same window. 33 new component spec tests.

C12 sweep findings — be9efc43, 22ee0865

• phx-disable-with added to Save / Test Connection / Disconnect /
  Delete buttons on integration_form.html.heex. Pre-fix, a
  double-click + slow network could submit two save requests or
  spawn parallel HTTP probes; data-confirm is friendlier UX but
  not a substitute.
• Narrowed Integrations.validate_connection/2's rescue e -> to
  three expected exception classes (DBConnection.OwnershipError,
  Postgrex.Error, Req.TransportError). Genuine logic bugs
  (KeyError, MatchError, etc.) now surface to the supervisor +
  Logger.error instead of getting swallowed under the generic
  "validation failed" message.
• Doc-only security note on Integrations.authenticated_request/4
  warning that the attached Bearer token leaks if the caller's
  url parameter comes from unvalidated user input. Internal
  callers (OpenRouterClient, OAuth refresh, userinfo) are safe;
  the AI module's Endpoint.validate_base_url/1 schema guard
  covers the operator-supplied case. The doc spells out that new
  callsites that take URLs from anywhere else need their own
  allowlist.

Permissions module_label("db") fix — 0d24c35e

• Pre-existing failure on upstream/dev: when the external
  phoenix_kit_db module isn't loaded (core's own test VM doesn't
  pull in feature modules), Permissions.module_label("db") falls
  through to String.capitalize("db") = "Db", but the test
  asserts "DB" (the registered shape from
  phoenix_kit_db.permission_metadata/0).
• db was extracted into its own module but core still references
  the key (phoenix_kit_web/users/auth.ex keeps a
  {"db", "/admin/db"} route). Same pattern as if "shop" were
  extracted later: the canonical label / icon / description belong
  in core's @core_* maps so the display is correct regardless of
  whether the external module is installed.
• Added three parallel entries (@core_labels "db" => "DB",
  @core_icons "db" => "hero-server-stack", @core_descriptions
"db" => "Database explorer and schema inspection") mirroring
  phoenix_kit_db.permission_metadata/0 verbatim — a host app
  loading both core and the external module sees the same values
  regardless of which lookup wins.
• Folded in to keep the post-rebase baseline green at 0 failures.

Upstream fixture fix — 3c9ca9f5

• The rebase brought in upstream's V113 (PR Updated the media browser with tessera #534, Tessera) which
  added the phoenix_kit_files_user_or_parent_check CHECK
  constraint requiring user_uuid IS NOT NULL OR parent_file_uuid IS NOT NULL. Existing fixtures in storage/scope_test.exs,
  media_browser_scope_test.exs, and media_browser_test.exs
  insert phoenix_kit_files rows with neither — fixture pattern
  predates V113. Reproduced on clean upstream/dev (93f242b3)
  via separate worktree, so confirmed not caused by this PR.
• Fix: each create_file!/1 now stamps user_uuid via a memoised
  ensure_user!/0 helper that registers an owner user once per
  test process. The user identity is incidental to every
  assertion in these tests; it exists only to satisfy the V113
  CHECK. Folded into this PR rather than a follow-up so the
  baseline mix test is clean — otherwise the next sweep would
  be unable to distinguish new regressions from upstream's
  pre-existing red.

Verification

Check	Result
mix compile --warnings-as-errors	clean
mix credo --strict	same pre-existing counts as upstream/dev (no new findings)
Targeted tests on changed files	162 / 162 pass
Full mix test	1229 tests, 0 failures. The 23 upstream Tessera-fixture failures (introduced by V113's phoenix_kit_files_user_or_parent_check CHECK constraint) are fixed in 3c9ca9f5 — each create_file!/1 fixture stamps user_uuid via a memoised ensure_user!/0 helper. The remaining Permissions.module_label("db") failure (which existed on clean upstream/dev, unrelated to this PR's primary scope) is fixed in 0d24c35e — "db" => "DB" added to @core_labels / @core_icons / @core_descriptions so core's display is correct even when phoenix_kit_db (which registers the same shape) isn't loaded. Targeted tests on this PR's changed files: 162 / 162.

Test plan

• V114 migration round-trip + idempotence + edge cases (9 tests)
• add_connection accepts spaces / punctuation / duplicates / leading symbols (4 tests)
• rename_connection accepts arbitrary names + duplicate targets (5 tests)
• list_connections + load_all_connections expose :date_added (6 tests)
• Form-clear preservation on empty-name create error (1 test)
• IntegrationPicker component spec — subtitle priority + masked
  credential + age + provider auto-resolve + 5 status branches
  + filter-by-provider + search threshold + empty state +
  deleted-card warning + click-action dispatch (33 tests)
• mix precommit
• for i in {1..3}; do mix test --exclude integration; done
  (stable on non-DB tests)

Renaming V113 → V114 across the migration, the test, the
@current_version constant, and the moduledoc changelog entry.