`connect()` wiring for interactive OAuth

[jlrobins]

• Goal: expose the whole strand through connect() and wire both auth views to the driver's
  three clients.
• Scope (in):
  • Auth-mode selection: auth="api_key" | "oauth" (or a prebuilt oauth_config), mutually
    exclusive with every API-key param — a specific InterfaceError per violating combination.
  • Acquire the process-wide holder (child 4); data_plane_auth → _client (Flink);
    control_plane_auth → both control-plane clients.
  • OAuth-aware credential guards: _get_controlplane_client / _get_connect_controlplane_client
    build with control_plane_auth instead of raising; the CMK global-key requirement lifts —
    _resolve_kafka_cluster_id resolves database → lkc-… with no global key (a genuine
    capability gain over API-key mode, not just parity).
  • organization_id discovery: omitted → resolved from the /api/sessions session; supplied →
    scopes the session and fills the Flink path; a mismatched later connect() raises
    InterfaceError. Reuses Infer organization_id from a global API key when the orgs route returns a singleton #132's connect()-time org-resolution seam.
  • Connection.close() → holder.release() (never provider.close()) — in the baseline this is
    bookkeeping only; it gains teeth (refcount-driven park) once the daemon lands in child 7.
• Out of scope: nothing structural — this is the assembly child.
• Depends on:Process-wide holder: one OAuth identity per process #154
• Prior art: ide-sidecar — org travels as we plan: ConnectionSpec.ccloudOrganizationId() →
  ExchangeControlPlaneTokenRequest(idToken, orgResourceId), with org_resource_id added to the
  /api/sessions body only when non-null (null ⇒ CCloud picks the default) — the
  supplied-vs-discovered fork our child mirrors; getCurrentOrganization() reads the resolved org
  back off the session response. mcp-confluent — client-arm wiring oauth-client-manager.ts (each
  arm's auth bound to the holder's getControlPlaneToken / getDataPlaneToken) is the analogue of
  wiring our two views onto the three clients; but org is handled outside the OAuth flow (env
  CONFLUENT_CLOUD_ORG_ID / FLINK_ORG_ID), so it has no session-discovery equivalent — our
  omitted-org discovery follows ide-sidecar, not mcp.
• Sized right: wiring + validation + guard edits + tests; all new machinery already landed and
  tested in OAuth primitives: pkce + token_chain + token_set #151, Local callback HTTP server #152, CCloudOAuth provider: login + on-request refresh + two auth views #153, Process-wide holder: one OAuth identity per process #154