preview provider connection identity and harness bindings without changing execution

[atomantic]

Summary

Read-only import preview for the provider connection graph designed in docs/plans/2026-09-06-provider-connections-and-harnesses.md. GET /api/providers/management/preview answers what an import would create from the provider records an install already runs — and which records it would leave alone, with reasons. It persists no graph, ships no migration, adds no management UI, and changes nothing about execution.

• server/lib/providerHarnesses.js — which agent program a record drives (claude / opencode / codex / antigravity / cursor / grok / kimi / pi), its supported modes and wire protocol, plus the model-name adapters. Canonicalizing a stored alias is verified against the real OpenCode adapter, so import never rewrites a saved model string by heuristically stripping a prefix.
• server/lib/providerConnections.js — what backend a record reaches. Identity compares real server-side credentials and refuses once a value has been redacted, so a sanitized record can never merge two connections. Dynamic env references, external harness config files, unparsable config, foreign namespaces and undeclared endpoints stay isolated with an explicit reason.
• server/lib/providerGraphPreview.js — the version-1 management DTOs (Zod, .strict()) and the builder. Only the already-proven same-harness CLI/TUI sibling groups (providerModeGroups) share a binding; two harnesses on one daemon surface as a link suggestion requiring explicit confirmation, never an automatic merge that would hand one route another's credentials. providerGraphUniquenessViolations checks the UNIQUE constraints the durable schema (Persist provider connections with recoverable legacy route projection #6367) will enforce, including the partial index for null-harness API bindings.

Every original executable route ID survives, and projectPreviewToProviders re-materializes each original record — pins, secrets, consent flags and unknown custom fields included. That is both the import-fidelity proof and the downgrade contract for an install that drops back to running providers.json alone. GET /api/providers is unchanged.

routeModeEligibility is the pure declarative half of mode eligibility (harness support + enabled + caller-allowed mode + text-transport consent); prerequisite probing and fallback candidate policy stay with #6368.

Test plan

• cd server && npm test — 2010 files / 39,950 tests green.
• New suites:
  • server/lib/providerConnections.test.js — transport identity: env-var vs endpoint transport, redacted credentials refused, remote host never equated with the local daemon, lossless owned-field round-trip.
  • server/lib/providerGraphPreview.test.js — the three fixtures from the issue (Claude Ollama, OpenCode Ollama, separate remote Ollama API), no cross-harness merge, custom same-harness config imported as a distinct variant, isolation reasons, unresolved aliases and stale pins, and a fidelity round-trip over the entire shipped provider catalog (49 records).
  • server/routes/providers.management.test.js — the route, no credential material in the body, GET /api/providers still byte-compatible, and the boundary test: serving the preview makes no outbound request, and nothing in the builder's static import closure can spawn a process, open a pty, or reach a service module.
• npm run generate:api-docs re-run; the catalog gains exactly the one new operation.

Closes #6366