Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/probe.go

@@ -48,6 +48,8 @@ const (
 	crispAPIBaseURL           = "https://api.crisp.chat/v1"
 	crispTierHeader           = "X-Crisp-Tier"
 	crispTierValue            = "plugin"
+	squareVersion             = "2026-05-20"
+	squareMerchantProbeURL    = "https://connect.squareup.com/v2/merchants/me"
 )
 
 // ProbeConnection verifies that the connector credential is accepted by the
@@ -615,3 +617,47 @@ func probePostHog(
 
 	return nil
 }
+
+// buildSegmentProbeURL builds the Segment users probe URL from the connector's
+// stored base URL (the region-resolved host). GET /users returns 401 on a dead
+// or under-scoped Public API token.
+func buildSegmentProbeURL(conn *coredata.Connector) (string, error) {
+	s, err := coredata.ConnectorSettings[coredata.SegmentConnectorSettings](conn)
+	if err != nil {
+		return "", fmt.Errorf("cannot read segment connector settings: %w", err)
+	}
+
+	if s.BaseURL == "" {
+		return "", fmt.Errorf("missing segment base URL")
+	}
+
+	u, err := url.Parse(s.BaseURL)
+	if err != nil {
+		return "", fmt.Errorf("cannot parse segment base URL: %w", err)
+	}
+
+	u.Path = "/users"
+	u.RawQuery = "pagination.count=1"
+
+	return u.String(), nil
+}
+
+// probeSquare checks a Square credential (OAuth Bearer token or Personal Access
+// Token) with a GET /v2/merchants/me, sending the required Square-Version
+// header. The endpoint returns 401 on a dead token and works for both OAuth and
+// PAT connections, which are always scoped to a single merchant.
+func probeSquare(
+	ctx context.Context,
+	httpClient *http.Client,
+	_ *coredata.Connector,
+) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, squareMerchantProbeURL, nil)
+	if err != nil {
+		return fmt.Errorf("cannot create probe request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+	req.Header.Set("Square-Version", squareVersion)
+
+	return doProbeRequest(httpClient, req)
+}