test(connection-tools): add robustness checks for malformed configuration state

[pedrofrxncx]

Add two edge-case tests to strengthen the connection-tools integration test suite and catch potential robustness issues.

Changes:

• Test rejects configuration_state with non-object values when scopes reference those keys (must be {value: id} shape)
• Test prevents cross-org credential grants by rejecting scopes that reference connections from other organizations

Why: These edge cases are real robustness risks: configuration_state validation checks key existence but not shape, and there's a trust boundary where scopes could accidentally reference another org's connections without validation. Adding these tests closes gaps in the test suite.

Verification:

• All format checks pass (bun run fmt)
• No lint errors (bunx oxlint)
• No TypeScript errors in workspace (bunx tsc --noEmit in apps/api)
• Tests are behavior-preserving — they exercise existing validation paths that should already reject these cases

Net delta: +96 lines of test code covering two critical edge cases.

---

Summary by cubic

Adds two edge-case tests to the connection-tools integration suite to catch malformed configuration state and cross-org credential grant issues. The tests verify that configuration_state values must be objects with a value field when referenced by scopes, and that scopes referencing connections from other organizations are rejected.

^{Written for commit 8e9c58c. Summary will update on new commits.}

[pedrofrxncx]

Closing as stale: this PR sat past the bot's 48h merge window, main has moved on, and its CI results no longer reflect the current base. This is a housekeeping close, not a rejection of the change — if the underlying problem still exists, the bot will find it again and open a fresh, rebased PR.

[studio-bot:stale-close]