Add explicit harness connection management and shared model editing

[atomantic]

Decision: docs/plans/2026-09-06-provider-connections-and-harnesses.md (planning issue #6359). Retain executable provider IDs for all saved selections; durable connection IDs are management-only. This is implementation work, separate from the planning deliverable.

Build Harness > Connection > Model and Direct API > Connection > Model management over the durable graph. Follow the decision document mock flows with explicit link previews and conflict choices; never infer sharing by vendor, labels, catalogs or redacted credentials.

Areas: client/src/pages/AIProviders.jsx, client/src/services/apiProviders.js, server/routes/providers.js, client/src/App.jsx, server/lib/navManifest.js, shared Drawer and provider selectors.

Acceptance:

• Add existing local Ollama connection to Claude/OpenCode while a remote Ollama API stays independent; new bindings start disabled without granting execution consent.
• Link previews affected routes/pins and transport/auth choices; unlink clones connection state while preserving executable IDs/defaults/fallbacks.
• Edit shared catalog/subsets, mode overrides and exact system default mode; catalog refresh retains pins on failures/removals and maps harness model aliases explicitly.
• Preserve /ai/new and /ai/edit/:providerId; new selections use registered URL params, palette/voice navigation parity, accessible keyboard/mobile controls and focus restoration.
• TUI Shell launch uses existing validation/lifecycle and explicit user action with saved state; configuration/enable/boot never generates or launches.
• Old-server fallback uses explicit unsupported/404 management responses; other errors stay errors.
• Boundary tests cover all six mock flows, stale client revision conflicts and secret-free DTOs.

Part of #6359
The parent is a completed planning deliverable, not an implementation epic; do not reopen it.

Blocked by #6367, #6368

[atomantic]

Partial ship in #6430 — the management edit surface over the durable graph. The issue stays open for the remainder below.

Done ✓

• ✓ Edit a shared backend once (label / transports / credentials) and materialize it into every route on it, per transport protocol — PATCH /api/providers/connections/:id
• ✓ Shared catalog refresh, one probe per backend for all its harnesses; failure retains the prior catalog with a credential-stripped reason; a partial result keeps both models and error — POST /api/providers/connections/:id/refresh-models
• ✓ Shared model subset per harness binding, with pins outside it kept and shown as stale — PATCH /api/providers/bindings/:id
• ✓ Stale-revision 409s on every write, re-checked inside the serialized graph pass; a mid-projection route blocks the edit
• ✓ Link preview naming the affected route ids and the transport/auth differences, applied only with the reviewed revisions; unlink clones the connection and keeps route ids, defaults and fallbacks
• ✓ Exact system-default mode — a route row names the executable providerId it would set
• ✓ Deep-linked, registered URLs: /ai/connections/:connectionId and /ai/harnesses/:harnessId/connections/:connectionId, in the nav manifest for ⌘K + voice parity; /ai/new and /ai/edit/:providerId preserved; shared Drawer for focus trap / Esc / restore, htmlFor+id pairing, stacked on mobile
• ✓ Old-server fallback on an explicit 404 / PROVIDER_GRAPH_UNAVAILABLE only; other errors stay errors
• ✓ Secret-free DTOs (hasCredentials, no projection snapshots), and the redaction placeholder refused rather than stored
• ✓ Boundary tests for the shared-edit, refresh, subset, stale-conflict and fallback flows

Remaining ▢

• ▢ Create a connection / binding (POST /api/providers/connections, POST /api/providers/bindings), i.e. mock flows 2 and 3 in the decision record. Minting a new executable route needs a per-harness command recipe PROVIDER_HARNESSES does not carry today — it classifies existing records rather than describing how to spawn a fresh one. That registry column is the real prerequisite and is its own change.
• ▢ Mode overrides (args / timeout / effort / tier pins) edited through the graph; today the panel links out to /ai/edit/:providerId
• ▢ TUI Launch in Shell from a mode row, on the existing validation/lifecycle path
• ▢ modelMap alias editing by hand (refresh records observed aliases; there is no correction UI)