feat(file-sources): map connectors to file-source adapters (PR 2/4)

[philmerrell]

Summary

Second PR in the file source connectors series. Builds on the adapter framework from #366 to let an admin mark a connector as a file source by mapping it to a registered adapter.

Backend

• OAuthProvider gains a nullable file_source_adapter_id — dataclass field, DynamoDB to/from_dynamo_item round-trip, OAuthProviderCreate/Update/Response, and provider_repository.apply_metadata_update. Legacy records without the field default to None.
• Admin create/update routes validate the mapping against the adapter registry: the adapter must exist and its compatible_provider_types must include the connector's type. Validation lives in the app_api route — apis.shared cannot import the app_api registry.
• New read-only GET /admin/file-source-adapters exposes the registry so the admin form can populate a dropdown.

Frontend

• The admin connector form gains a "File Source" section: an adapter dropdown filtered by provider-type compatibility, plus a scope-coverage warning when the connector's OAuth scopes don't cover what the adapter requires. Selecting an adapter is the opt-in; clearing it ("") removes the mapping.

Design notes

• file_source_adapter_id is the opt-in — there's no separate "is file source" boolean. Set = file source; null = not.
• A connector ≠ a file source: the connector is OAuth; the file-source capability exists only when an adapter is mapped. The admin dropdown only offers adapters compatible with the connector's provider type, so e.g. a Slack connector is never offered Google Drive.

Test plan

• 88 backend tests pass — model round-trip (incl. legacy records), validation helper (unknown adapter / incompatible type / valid / no-op), GET /admin/file-source-adapters endpoint, plus connectors + oauth + architecture regression suites
• ruff clean; mypy clean apart from the repo-wide pre-existing import-untyped noise
• Frontend production build succeeds — connector form component + template type-check cleanly
• Architecture import-boundary tests pass (registry validation is app_api-only)

Known issue (pre-existing, not introduced here)

connectors.service.spec.ts fails on a clean develop checkout — its TestBed setup chokes on a null HttpClientTestingModule (Angular test-infra version drift). The new fetchFileSourceAdapters test was added in the same style and will pass once that environment issue is fixed. Flagged separately.

🤖 Generated with Claude Code