Unify Connect onboarding and collection management

[callumalpass]

Summary

Implements the onboarding and collection-management umbrella task while keeping the SDK collection picker component out of scope.

• unifies account-first pairing, intent-aware continuation, existing-folder guidance, and durable authority-aware completion receipts
• adds opt-in popup authorization with redirect fallback, in-place session completion, isolated-window handling, and reauthorization access deltas
• makes desktop, Connect management, and transactional approval terminology explicit; existing grants can only be narrowed or revoked
• replaces duplicate transfer confirmations with one consequential approval, adds preflight/progress/receipt UI, and groups retired authority as history
• makes development editor deployments lab-first and rejects accidental staging/production targets
• moves release/download/SDK documentation consistency to the companion mdbase.dev PR

Verification

• full workspace typecheck
• full Node build, architecture, accessibility, test, package audit, and release-readiness suite in CI
• client tests (203)
• editor tests (283)
• portal tests (10)
• desktop tests (66)
• targeted server live-authorization tests
• popup authorization approved live in lab: popup self-closed and the existing editor session resumed with the collection
• Electron source build exercised against the isolated lab daemon; current management and transfer-readiness states rendered against the live lab account
• development editor deployed at https://candidate-b.mdbase-editor.pages.dev/

Related delivery

Canonical website release metadata and authenticated publication checks: mdbase-dev/mdbase.dev#23

Delivery boundary

Lab only during implementation. Staging and production have not been changed and remain explicitly excluded until acceptance is complete and promotion is discussed.