feat(solcast): add Solcast solar PV forecast connector

[andrei-hasna]

Summary

• Add @hasna/connect-solcast package under connectors/solcast/ with typed REST client, Commander CLI, config utils, and docs
• Register solcast in Data & Analytics (src/lib/connectors/data-analytics.ts)
• Cover forecast/live/historic rooftop PV, site forecasts/actuals, and raw GET against https://api.solcast.com.au

Test plan

• connectors/solcast: bun run typecheck, bun run build, bun test src/api/client.test.ts (5 pass)
• Repo: bun run typecheck, bun run build, bun test src/lib/registry.test.ts (28 pass)
• Full suite: 1191 pass / 1 fail (pre-existing CLI > events isolation test, unrelated to solcast)
• Security scan: no hasnaxyz/beepmedia/platform-alumia/browser-use refs in changed paths

[andrei-hasna]

Automated merge review for task 4ccddb87-e262-42a8-8724-cdc7b8742b9f is blocking merge for now.

Validation evidence:

• PR is open/non-draft; author andrei-hasna; base main; head open-connectors-cursor/open-connectors/20125311-11c0-43e7-a082-2f0f80b64265-f4ddd744.
• GitHub CI / build check is passing.
• Local merge of PR head into current origin/main applied cleanly.
• Local validation passed after installing deps with sandbox-safe Bun cache paths:
  • bun test connectors/solcast/src/api/client.test.ts -> 5 pass, 0 fail
  • connector-local bun run typecheck -> pass
  • connector-local bun run build -> pass
  • root bun run typecheck -> pass
  • root bun run build -> pass
  • HOME=/tmp/open-connectors-test-home bun test -> 2269 pass, 0 fail
• A default-home bun test run failed because the managed worker cannot write to /home/hasna/.hasna/connectors; rerunning with writable HOME made the same suite pass, so that is environmental evidence rather than a Solcast regression.
• Blacklist/security scan found no browser automation dependency, no blacklisted scraper connector, and no hardcoded real secrets/internal beepmedia or hasnaxyz references in the Solcast files.

Merge blockers found by adversarial review:

1. connectors/solcast/src/utils/config.ts stores credentials in ~/.hasna/connectors/connect-solcast/config.json, while the shared dashboard/server auth path saves API keys in profile storage under the normalized connector config directory. Result: a key saved via dashboard/shared auth will not be used by connect-solcast, and a key saved via connect-solcast config set-key will not be reflected as configured in shared auth status.
2. saveConfig() writes the API key JSON without restrictive file permissions. On a typical umask this can create a credential file that is readable more broadly than intended. New credential-writing connector code should write profile/config files with owner-only permissions.
3. loadConfig() creates the config directory on read. In a read-only home this can fail before the CLI prints the intended missing-key error. This is lower severity than the two auth/storage blockers but should be fixed while touching the config layer.

Recommended fix: update Solcast config handling to use the repo's profile-compatible connector config convention, make read-only config reads side-effect-free, and write any credential-bearing files/directories with owner-only permissions. Add focused tests covering dashboard/profile-saved key lookup and credential file mode.