fix(connector): stop lying about state, and say why sign-in failed

[AVADSA25]

Three defects, all reported from live use, all confirmed against the real endpoints.

1. GitHub's "Sign in" did nothing

Not a UI bug. GitHub's MCP server publishes no OAuth metadata at all, so fastmcp's Dynamic Client Registration 404s and the flow dies before a browser can open:

OAuthRegistrationError: Registration failed: 404 404 page not found

Probed to confirm:

Server	/.well-known/oauth-authorization-server	registration_endpoint
Notion	200	https://mcp.notion.com/register ✅
GitHub	404	none — OAuth sign-in is impossible
Hugging Face	200	https://huggingface.co/oauth/register

The error was swallowed. signin_server now never raises and maps each failure to an actionable message — GitHub's says it needs a personal access token under headers, not OAuth.

2. Hugging Face said "Connected" though nobody signed in

It's an open endpoint (auth: none). There is no session — which is also why the card offered no way out. "Connected" reads as "someone signed in here", which is false. Now: "Ready — open endpoint, no sign-in needed", with no Sign out, because there is nothing to end.

3. Failures vanished before they could be read

Sign-in errors were toasts. They now stay on the card until the next attempt.

Also renames Disconnect → Sign out — it matches what the button actually ends.

State machine

Condition	Shows
off	just the toggle
oauth + signed in	● Signed in · Sign out
oauth + not signed in	Needs OAuth sign-in · Sign in
api_key + configured	● Connected via API key
api_key + missing	Needs an API key in mcp_servers.json
open endpoint	● Ready · open endpoint — no sign-in needed

Tests

Error mapping verified across all four failure modes (DCR 404 → PAT instructions; registration 500 → rejected-registration; timeout → check URL/online; unknown → raw detail). py_compile clean on both changed Python files.