fix(auth): keep pairing credentials out of link listings

[rynfar]

Pairing-link listings currently return credentials that let someone join an environment. This change returns link metadata for listing and revocation, while keeping the credential available only in the response that creates a new link. Pylon’s Share panel, endpoint selection, QR code, and copy actions continue to work for newly created links during the current Settings visit.

Selectively adopts upstream pingdotgg/t3code#9523 (9d28c21a26aeef198cb064fe466e49cbeabfe09c). Existing links can still be listed and revoked; create a new link after leaving Settings to share again. The user guide explains this behavior.

Validation: 193 focused tests across server authorization, pairing storage and wire responses, CLI formatting, client authorization, pairing URLs, and Connections settings; scoped contracts, client-runtime, server, web, and mobile typechecks; changed-file lint. Rebased server authorization tests rerun against the connection-renewal changes. Integrated client verification completed; evidence below.

Integrated sandbox verification created an actual pairing link. The baseline still offered Copy code after reload. The candidate offered Copy code only immediately after creation, then retained metadata and Revoke after reload with no copy control. The sandbox remained bound to loopback; a renderer-only remote-policy fixture exposed the Connections controls. After the final rebase, 167 server authorization tests passed.

Model: GPT-6 Astra. Harness: Codex.

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.6 KiB	13.8 KiB	+170 B (+1.2%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.1 KiB	7.1 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.6 KiB	6.7 KiB	+172 B (+2.6%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	56.5 KiB	57.4 KiB	+910 B (+1.6%)	66.4 KiB	✅
Codex	Live turn messages	8	10	+2 (+25.0%)	21	✅
Claude	Total thread wire	13.8 KiB	13.8 KiB	−26 B (−0.2%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.1 KiB	7.1 KiB	−3 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.7 KiB	−23 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.2 KiB	58.2 KiB	0 B (0.0%)	66.4 KiB	✅
Claude	Live turn messages	10	10	0 (0.0%)	21	✅

Baseline: 71b11a4 · PR result: 5e97143 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 111.2 KiB
• Claude decoded thread snapshot: 111.9 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.