* feat(session): show the connect card when code ran unconnected

A run_code result in a chat that finds a late sandbox grant unconnected
now begins the binding's consent and shows its connector_authorization
card on the reply, holding nothing, once per open consent. A watch reads
the connection every loginPoll and hands a consent finished on another
router back as the callback does, so the session carries on (AI-1982).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NAcw89MQVDgDgdvZM4RaGh

* AI-1982: A run shows no new consent once one ended without connecting

A consent used up without connecting (declined or failed, on this router's
callback or, read from its attempt, on another's) stops its watch, and a run
of code shows no new consent for that binding; list_tools still begins one.
Tests cover the watch's connected-anew rule for a connection to reconnect.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NAcw89MQVDgDgdvZM4RaGh

* AI-1982: Keep watching a consent after its attempt was used up

A callback uses the attempt up before the token exchange stores the connection, so a poll
between the two ended the watch for a consent that then connected.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NAcw89MQVDgDgdvZM4RaGh

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>