Add Google Analytics, Dotfile, Segment and Square access-review connectors

Two OAuth2 and two API-key connectors:

- Google Analytics (GA4): OAuth2 with both analytics.readonly and
  analytics.manage.users.readonly (readonly alone 403s on the accounts
  list); v1alpha accessBindings enumerated at account and property level
  and merged by email; manual account picker (Pattern 1) with a
  per-connection probe and name resolver; distinct from Google Workspace.
- Dotfile: API key in the X-DOTFILE-API-KEY header (Pattern 3); GET
  /v1/users (owner/admin, suspended_at) with a static probe.
- Segment (Twilio): Public API token as Bearer with a required Region
  setting (US or EU) mapped to the regional host; GET /users plus per-user
  GET /users/{id} for roles and /invites for pending members; per-connection
  BuildProbeURL.
- Square: OAuth2 (EMPLOYEES_READ) or a personal access token (Pattern 3);
  POST /v2/team-members/search returns email/status/is_owner directly, so no
  role resolution; custom probe and name resolver.

Google Analytics and Square are confidential OAuth clients, wired into the
bootstrap OAuth provider list and .env.example. Segment carries a required
extra setting, so the console add-source dialog maps region onto its
segmentRegion API-key input; without that mapping the value is silently
dropped and the create is rejected.

Cassette-backed driver tests plus unit tests for the Segment probe URL and
the bootstrap OAuth provider list.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/server/api/console/v1/connector_settings.go

@@ -328,6 +328,27 @@ func apiKeyConnectorSettings(input types.CreateAPIKeyConnectorInput) (json.RawMe
 		}
 
 		return json.Marshal(&coredata.ScalewayConnectorSettings{OrganizationID: *input.ScalewayOrganizationID})
+	case coredata.ConnectorProviderSegment:
+		region := ""
+		if input.SegmentRegion != nil {
+			region = strings.ToUpper(strings.TrimSpace(*input.SegmentRegion))
+		}
+
+		// The region selects the API host and is not discoverable from the
+		// token; resolve it to a base URL against a fixed allow-list so an
+		// unexpected value cannot reach the driver.
+		var baseURL string
+
+		switch region {
+		case "US":
+			baseURL = "https://api.segmentapis.com"
+		case "EU":
+			baseURL = "https://eu1.api.segmentapis.com"
+		default:
+			return nil, fmt.Errorf("cannot create segment connector: segmentRegion must be US or EU")
+		}
+
+		return json.Marshal(&coredata.SegmentConnectorSettings{BaseURL: baseURL})
 	case coredata.ConnectorProviderCrisp:
 		websiteID := ""
 		if input.CrispWebsiteID != nil {

pkg/server/api/console/v1/graphql/connector.graphql

@@ -99,6 +99,15 @@ enum ConnectorProvider
     RAILWAY
         @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderRailway")
     CRISP @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderCrisp")
+    DOTFILE
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderDotfile")
+    SEGMENT
+        @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderSegment")
+    SQUARE @goEnum(value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderSquare")
+    GOOGLE_ANALYTICS
+        @goEnum(
+            value: "go.probo.inc/probo/pkg/coredata.ConnectorProviderGoogleAnalytics"
+        )
 }
 
 type ConnectorProviderInfo {
@@ -202,6 +211,7 @@ input CreateAPIKeyConnectorInput {
     langfuseBaseUrl: String
     scalewayOrganizationId: String
     crispWebsiteId: String
+    segmentRegion: String
 }
 
 type CreateAPIKeyConnectorPayload {