Context source form: pick an account, not a token

[artyomsv]

Goal

A context source stops holding a token and picks an account instead. This is what removes the
duplicate tokens the operator complained about.

Changes to spire-ui/src/components/SettingsContextProviders.tsx

Remove: the auth-kind select, the username field and the secret field.

Add: an Account picker, filtered to the kinds that can serve this source type:

Source type	Accounts offered
github-issues	github
code	github, gitlab
gitlab-issues	gitlab
jira	atlassian
confluence	atlassian

Keep: the source type, the base URL, and the source-specific fields — Jira/Confluence
projectKeys, the code path allowlist.

These stay per source, not per account, and that is deliberate. One Jira account serving two
projects wants two key lists; one GitHub account may read code under one path allowlist and issues
under another repository list. Moving them onto the account is the wrong grain, and is one of the
reasons Option B was rejected.

An empty picker

If no compatible account exists, show "Register an account first" with a link to
/settings/accounts. Never render an empty select — an operator cannot tell an empty list from a
broken load.

Connectivity check

Check now probes through the account's credential. The result is still recorded on the source
(last_check_ok / last_check_error), because a source can fail for reasons the account is fine
with — a wrong project key, a path allowlist that matches nothing.

Traps

• Context providers fail soft. A source that resolves nothing looks exactly like a pull request
  with no context. Do not let a mis-wired picker become a silent no-op: if the selected account is
  disabled, say so on the row.
• styles.contract.test.ts fails the build for undefined classes.
• Icons: lucide-react, never emoji.

Acceptance

• The source form has no token, username or auth-kind field.
• The picker offers only compatible account kinds. Mutation-verify: drop the filter, an
  Atlassian account must not be offered for github-issues.
• With no compatible account, the form says "Register an account first" and links to Accounts.
• Saving a source stores account_id and no secret.
• Check probes with the account's credential and records the result on the source.
• A source whose account is disabled says so on the row.
• An existing migrated source opens with its account preselected.
• styles.contract.test.ts green; npx tsc --noEmit silent.

---

Part of #148