Verify Crisp website ownership before connecting

Crisp is a managed (Model B) connector: Probo holds one plugin token
server-side and each connection carries only a Website ID. Nothing
stops one organization from entering another organization's Website
ID, so prove control of the website before creating the connection.

Probo derives a per-(organization, website) verification code as an
HMAC over the token secret and exposes it through a new
crispVerificationCode query. The customer pastes it into the Probo
plugin's per-website settings; at connect time the resolver reads the
setting back through the managed plugin token and requires a
constant-time match before any row is written. The managed key and
plugin ID come from bootstrap, so the connector stays hidden until the
deployment configures them.

The settings fetch is injected so the create-time gate's branch wiring
is unit-tested (mismatch and not-subscribed reject, internal errors
stay generic, a matching code passes), and the managed-versus-client
key resolution is covered too.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/crisp.go

@@ -26,11 +26,19 @@ import (
 
 func crispRegistration() *Registration {
 	return &Registration{
-		Provider:       coredata.ConnectorProviderCrisp,
-		DisplayName:    "Crisp",
-		SupportsAPIKey: true,
-		// Crisp authenticates with a plugin token presented as HTTP Basic, the
-		// credential being the verbatim "identifier:key" pair.
+		Provider:    coredata.ConnectorProviderCrisp,
+		DisplayName: "Crisp",
+		// Model B: the plugin token is Probo's own Crisp Marketplace plugin
+		// credential, held server-side in bootstrap config, not pasted by
+		// the customer. ManagedAPIKey injects it at connect time; the
+		// customer supplies only the Website ID. SupportsAPIKey stays false
+		// so the provider is hidden from the driver catalog until the
+		// operator configures PROBOD_CONNECTOR_CRISP_PLUGIN_TOKEN — it ships
+		// deactivated until Crisp validates the production plugin and
+		// activates with no code change once the token is set.
+		ManagedAPIKey: true,
+		// Crisp authenticates with the plugin token presented as HTTP Basic,
+		// the credential being the verbatim "identifier:key" pair.
 		// APIKeyBasicAuthUserPass base64-encodes it (the empty-password
 		// APIKeyBasicAuth cannot carry the key). A plugin token can serve
 		// several websites, so the reviewed website is captured via