Add five API-key access-review connectors

Add Mercury, Apollo.io, Deepgram, ClickHouse Cloud, and Langfuse as
access-review connectors. All are API-key, single-tenant providers
(Pattern 3): the key identifies one tenant, so there is no OAuth flow,
picker UI, or bootstrap/helm configuration.

- Mercury: Bearer token, GET /api/v1/users, cursor pagination.
- Apollo.io: x-api-key header, GET /api/v1/users/search (teammates).
- Deepgram: Token scheme; lists members across every project and
  dedupes by member_id, unioning per-project scopes.
- ClickHouse Cloud: HTTP Basic (keyId:keySecret); discovers the org
  via GET /v1/organizations, then lists its members.
- Langfuse: HTTP Basic (publicKey:secretKey); a base-URL setting
  selects the regional cloud host or a self-hosted instance.

Each adds the enum value, migration, GraphQL binding, provider
Registration, a driver with a cassette-driven test, and a brand logo.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/accessreview/drivers/langfuse_test.go

@@ -0,0 +1,74 @@
+// Copyright (c) 2026 Probo Inc <hello@probo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package drivers
+
+import (
+	"context"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+func TestLangfuseDriver(t *testing.T) {
+	t.Parallel()
+
+	rec := newRecorder(t, "testdata/langfuse", "LANGFUSE_API_KEY")
+	// Langfuse authenticates with HTTP Basic (publicKey:secretKey). The
+	// matcher ignores Authorization, so replay needs no auth.
+	client := newVCRClient(rec, basicAuthUserPass(os.Getenv("LANGFUSE_API_KEY")))
+
+	driver := NewLangfuseDriver(client, "https://cloud.langfuse.com")
+	records, err := driver.ListAccounts(context.Background())
+	require.NoError(t, err)
+	require.Len(t, records, 4)
+
+	owner := records[0]
+	assert.Equal(t, "lf-user-1", owner.ExternalID)
+	assert.Equal(t, "owner@example.com", owner.Email)
+	assert.Equal(t, "Olivia Owner", owner.FullName)
+	assert.Equal(t, []string{"Owner"}, owner.Roles)
+	assert.True(t, owner.IsAdmin)
+	assert.Equal(t, coredata.AccessReviewEntryAccountTypeUser, owner.AccountType)
+
+	admin := records[1]
+	assert.Equal(t, []string{"Admin"}, admin.Roles)
+	assert.True(t, admin.IsAdmin)
+
+	member := records[2]
+	assert.Equal(t, []string{"Member"}, member.Roles)
+	assert.False(t, member.IsAdmin)
+
+	viewer := records[3]
+	assert.Equal(t, []string{"Viewer"}, viewer.Roles)
+	assert.False(t, viewer.IsAdmin)
+	// name is empty in the payload, so the email is used as the display name.
+	assert.Equal(t, "viewer@example.com", viewer.FullName)
+}
+
+func TestLangfuseRoles(t *testing.T) {
+	t.Parallel()
+
+	assert.Equal(t, []string{"Owner"}, langfuseRoles("OWNER"))
+	assert.Equal(t, []string{"Admin"}, langfuseRoles("ADMIN"))
+	assert.Equal(t, []string{"Member"}, langfuseRoles("MEMBER"))
+	assert.Equal(t, []string{"Viewer"}, langfuseRoles("VIEWER"))
+	assert.Equal(t, []string{"None"}, langfuseRoles("NONE"))
+	assert.True(t, langfuseIsAdmin("OWNER"))
+	assert.True(t, langfuseIsAdmin("ADMIN"))
+	assert.False(t, langfuseIsAdmin("MEMBER"))
+}