Summary

• ManageAccessDialog: Rename ManageSecretsDialog to ManageAccessDialog, extending it to manage both secrets and app connections per agent. In selective mode, the dialog shows two sections (Secrets + App connections) with checkboxes, shared search, and combined count.
• Agent-app-connection assignment: Add getAgentAppConnections and updateAgentAppConnections service functions and server actions with audit logging.
• Always-visible connect button: The "Connect {App}" button on app detail pages now always shows when not connected, even without default credentials configured. Clicking it opens the connect popup which handles the BYOC flow.

Test plan

• pnpm check passes (lint, types, format)
• Agent card shows combined count ("2 secrets, 1 app" or "All credentials")
• "Manage access" dropdown item opens the unified dialog
• Selective mode shows secrets and app connections with checkboxes
• Saving selective mode persists both secret and app connection assignments
• Gateway only injects selected credentials for agents in selective mode
• Connect button visible on app detail page even without default credentials