Hide managed connectors until fully configured

A managed (Model B) connector like Crisp needs both the Probo-held key
and a resource ID (the plugin ID) to connect, but the driver catalog
gated visibility on the key alone. A deployment that set the key without
the plugin ID (reachable through raw JSON config; the bootstrap env path
already requires both) would show Crisp as connectable and then fail
every attempt with an internal error.

Add a RequiresManagedResourceID flag to the registration and a
Registry.ManagedConnectorReady check that requires both before a managed
provider enters the catalog, so a half-configured provider stays hidden
instead of dead-ending at connect.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/console/v1/base_resolvers.go

@@ -575,10 +575,12 @@ func (r *queryResolver) AccessReviewDrivers(ctx context.Context) ([]*types.Conne
 		clientCredentialsSupported := reg.SupportsClientCredentials
 
 		// ManagedAPIKey (Model B, e.g. Crisp) providers are connectable only
-		// once the operator configures the Probo-held key; until then they
-		// stay hidden, so such a provider ships deactivated.
-		_, hasManaged := r.providerRegistry.ManagedAPIKey(provider)
-		apiKeyManaged := reg.ManagedAPIKey && hasManaged
+		// once the operator configures the Probo-held key (and any required
+		// resource ID, e.g. Crisp's plugin ID); until then they stay hidden, so
+		// such a provider ships deactivated. Gating on full readiness keeps a
+		// half-configured provider out of the catalog rather than surfacing it
+		// and failing at connect time.
+		apiKeyManaged := r.providerRegistry.ManagedConnectorReady(provider)
 
 		// Skip providers that cannot be connected in this deployment: no
 		// OAuth client credentials configured and no key-based fallback