feat(broker): Tier 3 synthetic connection health checks for non-OAuth2 providers

[sangalo20]

Context

The health check architecture document describes a Tier 3: Synthetic User Refresh check for business-critical and non-OAuth2 providers. This is not yet implemented.

Description

For API key and basic auth providers where no refresh token exists, maintain a "Synthetic Connection" — a real, authorized connection belonging to a test bot account — and periodically validate it end-to-end.

Tasks

• Design the synthetic connection seeding mechanism (manual setup or auto-provisioned)
• Add a synthetic: true flag to the connections table to identify these connections
• Update ConnectionHealthWorker to run Tier 3 checks against synthetic connections
• Document which providers require Tier 3 and how to provision synthetic credentials

References

• docs/healthchecks.md §2 Tier 3 description
• nexus-broker/internal/service/connection_health.go