feat(salesforce): add JWT bearer flow and sandbox OAuth support - #6508

…redential tool

A credential stored under an alternate authorization server was recorded in
`connectedProviderIds` under its own id, while the not-connected list compares
against the service's canonical id — so a sandbox-only Salesforce user was
reported as both connected and not connected. Record the canonical id instead.

Also types the JWT test's assertion decoder instead of returning `any`.

An independent audit swarm found four real defects in the JWT bearer work:

- The credential update hook rebuilt its request body from a hand-written
  allowlist, so `authMethod`, `privateKey`, and `username` were silently
  dropped. A JWT private key could never be rotated through the UI, and
  switching grants failed with a generic error. Forwards the whole contract
  body instead, so a field added to the contract later cannot be lost again.
- `getInstanceUrl` guarded only the `sub` claim against login-host origins, so
  a sandbox id token whose `profile` was rooted at test.salesforce.com yielded
  the login host as the org's API base. Both claims are now guarded, and a
  guarded-away `profile` falls through to `sub` instead of ending the lookup.
- `canonicalizeServiceProviderId` replaces the previous fold, which also
  matched family-wide service-account ids and so dropped one arbitrary sibling
  product (Gmail, Confluence) from the copilot's not-connected list.
- The private key was collected in a plain textarea, leaving browser spell
  check and autofill free to ship it to third parties.

Also restores the explicit https check on the userinfo-derived instance URL,
anchors the scope marker, caps the accepted RSA modulus, and stops single-grant
providers paying for a stored-blob decrypt on every reconnect.

Docs: the JWT path no longer tells readers to enable the Client Credentials
Flow, and calls out the my.salesforce-setup.com host as the likely wrong paste.

Adds coverage for the paths the audit proved untested: partitionClientCredentialFields,
credentialProviderMatchesService's alternate-server clause, reconnect
carry-forward, the typographic-apostrophe error branch, and the passphrase hint.

…ned-profile errors

Verification against Salesforce's own sfdx-core surfaced two gaps:

- `gs1` Government Cloud orgs have ordinary *.my.salesforce.com hosts, but
  Salesforce requires `https://gs1.salesforce.com` as the JWT audience. The
  host regex accepted them, so they would have failed with an opaque audience
  error. The token still posts to the org's own host; only `aud` differs.
- `invalid_app_access` — Permitted Users is set to admin-pre-authorized but the
  run-as user's profile was never assigned to the app — is the likeliest
  misconfiguration and had no hint at all.

Also sends `iat`, matching sfdx-core and every mainstream implementation, and
softens two TSDoc claims that were stronger than the evidence: Salesforce does
not hard-reject a far-future `exp` (its own CLI ships one), and My Domain is the
right audience for commercial orgs rather than universally.

Two more surfaces resolved a credential to its service by exact provider id:

- `credentialsForTarget` compared only `providerId`/`baseProviderId`, so a
  sandbox-only user's Salesforce chip in Chat read as disconnected and
  re-prompted them to connect. The alternate ids are passed in by the caller
  rather than resolved in the module, which is `'use client'` and would
  otherwise pull the OAuth provider registry into the chat bundle.
- `createConnectDraft` resolved the service name by exact id, so a sandbox
  connect defaulted to the label "My salesforce-sandbox".

…rification

The chip's live target was widened to match a sandbox credential, but the
post-connect verification leg re-reads the STORED attempt, which did not carry
the ids — so completing a sandbox connect from Chat was detected as a failure
and the chip was marked failed. The attempt now persists them; attempts written
before this simply match as they did, and they expire within 15 minutes.

Also marks the auth-method picker required while it is the field blocking
submit on a reconnect, so the greyed button has a visible cause.

…a prefix

`startsWith('gs1-')` was invented from a paraphrase of sfdx-core and would have
misrouted an ordinary org like gs1-widgets.my.salesforce.com to the GovCloud
audience — breaking a setup that works today. sfdx-core's host signal is the
literal gs1.my.salesforce.com; its other signal is the org's createdOrgInstance,
which we never see. Matching exactly means a miss falls back to My Domain, which
is the behaviour before the branch existed, while a false positive cannot happen.

Also replaces the hand-rolled origin regex in getInstanceUrl with URL parsing,
which normalizes userinfo, ports, and case before the login-host comparison, and
drops two error hints that had no evidence behind them.