[adm 4] Restore external API connection and discovery

[artiphishle]

Closes #119

Scope

• consume @ankhorage/data-sources ^0.6.0 as the canonical discovery, normalization and endpoint-test owner
• connect existing APIs from /ankh/apis through automatic OpenAPI discovery or explicit GraphQL introspection
• preserve a manual REST fallback through the canonical REST source helper
• upsert normalized sources directly into the editable Studio manifest without a parallel API catalog
• list connected sources and normalized operations with method, path, protocol and intent details
• provide credential-safe Dry run and Execute actions through the canonical endpoint test runner
• expose package-neutral source-ID normalization and registry-upsert helpers through @ankhorage/studio/externalApiAuthoring

Trusted host boundary

• the browser submits only authoring intent and provider-neutral credential references
• credential values are resolved only in the trusted Studio host through ProjectSecretService
• external transport accepts HTTP/HTTPS only, rejects redirects and inline URL credentials, blocks known cloud-metadata targets, and applies timeout and response-size limits
• browser-readable operation diagnostics omit request headers and bodies and redact query values

Canonical persistence

Successful OpenAPI discovery, GraphQL introspection and manual REST creation write the resulting DataSourceConfig directly to manifest.dataSources. Reusing a normalized source ID updates the canonical source. Studio does not duplicate protocol parsing, normalization or runtime execution.

Validation

Final regular CI run 31074055046 is green on head f317eecfc16938e7dd342758c0c5316a96b9e8b9:

• frozen Bun install
• package build
• Ankhorage repository validation / doctor
• lint and format check
• Knip
• 452 active tests passed, 3 environment-gated tests skipped, 0 failed
• Studio workspace Expo web smoke
• generated app /ankh Expo web E2E
• package TypeScript check
• changeset status

Additional isolated web/package validation run 31073867050 is green:

• Studio web smoke
• generated app web E2E
• npm pack --dry-run

The ADM4 finalizer run 31073707674 also verified dependency/lockfile synchronization, Paradox generation and apps/studio TypeScript checking.

Changeset

.changeset/calm-external-apis.md

Convergence impact

apps/studio now authors the same canonical manifest data sources consumed by ordinary Ankhorage apps and delegates protocol behavior to the same shared package. No Studio-only API catalog, protocol normalizer or execution model was introduced.