Add four API-key access-review connectors

Add Pylon, OpenRouter, incident.io and Brevo as access-review connectors.
All are API-key, single-tenant providers (Pattern 3): the key identifies
one tenant, so there is no OAuth flow, picker UI, or bootstrap/helm
configuration.

- Pylon: Bearer token, GET /users; resolves each user's opaque role_id to
  a role name via GET /user-roles, with cursor pagination.
- OpenRouter: Bearer management key, GET /api/v1/organization/members. The
  endpoint requires an organization account -- a personal key authenticates
  but returns 404 -- so the connection probe rejects 404 on top of 401/403
  (doProbeRequest gained an opt-in extra-reject set) to surface a non-org
  key at connect time instead of mid-campaign.
- incident.io: Bearer token, GET /v2/users. Its OAuth is outbound-only, so
  the API key is the inbound path; live base_role/custom_roles take
  precedence over the deprecated role enum.
- Brevo: API key in the api-key header (Registration.APIKeyHeader), GET
  /v3/organization/invited/users. A live recording corrected the documented
  schema: is_owner is a JSON boolean (not a string) and an id field is
  present, so it is used as the stable ExternalID.

The OpenRouter and Brevo cassettes are anonymized live recordings; Pylon
and incident.io use hand-authored fixtures (no self-serve test tenant). The
shared three-valued active-status mapping is consolidated into
activeFromStatus in driver.go.

Each adds the enum value, migration, GraphQL binding, provider
Registration, a driver with a cassette-driven test, and a brand logo.

Signed-off-by: Aurélien Sibiril <81782+aureliensibiril@users.noreply.github.com>

pkg/connector/provider/probe.go

@@ -22,6 +22,7 @@ import (
 	"io"
 	"net/http"
 	"net/url"
+	"slices"
 	"strings"
 
 	"go.probo.inc/probo/pkg/connector"
@@ -29,14 +30,15 @@ import (
 )
 
 const (
-	anthropicAPIVersion     = "2023-06-01"
-	anthropicUsersProbeURL  = "https://api.anthropic.com/v1/organizations/users?limit=1"
-	herokuAccountProbeURL   = "https://api.heroku.com/account"
-	linearGraphQLEndpoint   = "https://api.linear.app/graphql"
-	mondayGraphQLEndpoint   = "https://api.monday.com/v2"
-	posthogOrganizationPath = "/api/organizations/@current/"
-	posthogUSBaseURL        = "https://us.posthog.com"
-	posthogEUBaseURL        = "https://eu.posthog.com"
+	anthropicAPIVersion       = "2023-06-01"
+	anthropicUsersProbeURL    = "https://api.anthropic.com/v1/organizations/users?limit=1"
+	herokuAccountProbeURL     = "https://api.heroku.com/account"
+	openRouterMembersProbeURL = "https://openrouter.ai/api/v1/organization/members?limit=1"
+	linearGraphQLEndpoint     = "https://api.linear.app/graphql"
+	mondayGraphQLEndpoint     = "https://api.monday.com/v2"
+	posthogOrganizationPath   = "/api/organizations/@current/"
+	posthogUSBaseURL          = "https://us.posthog.com"
+	posthogEUBaseURL          = "https://eu.posthog.com"
 )
 
 // ProbeConnection verifies that the connector credential is accepted by the
@@ -112,7 +114,12 @@ func probePOSTJSON(
 	return doProbeRequest(httpClient, req)
 }
 
-func doProbeRequest(httpClient *http.Client, req *http.Request) error {
+// doProbeRequest executes a probe request and maps the status to a verdict:
+// 401/403 always mean the credential is rejected, any 2xx/other status means
+// connected. extraReject lets a provider add statuses that also mean a hard
+// rejection (e.g. OpenRouter's 404 for a non-organization key); pass none for
+// the default 401/403-only contract.
+func doProbeRequest(httpClient *http.Client, req *http.Request, extraReject ...int) error {
 	resp, err := httpClient.Do(req)
 	if err != nil {
 		return fmt.Errorf("probe request failed: %w", err)
@@ -123,7 +130,9 @@ func doProbeRequest(httpClient *http.Client, req *http.Request) error {
 		_ = resp.Body.Close()
 	}()
 
-	if resp.StatusCode == http.StatusUnauthorized || resp.StatusCode == http.StatusForbidden {
+	if resp.StatusCode == http.StatusUnauthorized ||
+		resp.StatusCode == http.StatusForbidden ||
+		slices.Contains(extraReject, resp.StatusCode) {
 		return fmt.Errorf("credential rejected: status %d", resp.StatusCode)
 	}
 
@@ -431,6 +440,27 @@ func probeHeroku(
 	return doProbeRequest(httpClient, req)
 }
 
+// probeOpenRouter verifies an OpenRouter management key. Beyond the usual
+// 401/403, it treats 404 as a rejection too: a personal (non-organization)
+// key authenticates but the members endpoint returns 404 "This endpoint is
+// only available for organization accounts" (verified live) — a permanent,
+// not transient, signal that the connector can never list anyone, so it
+// surfaces at connection time instead of failing a campaign later.
+func probeOpenRouter(
+	ctx context.Context,
+	httpClient *http.Client,
+	_ *coredata.Connector,
+) error {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, openRouterMembersProbeURL, nil)
+	if err != nil {
+		return fmt.Errorf("cannot create probe request: %w", err)
+	}
+
+	req.Header.Set("Accept", "application/json")
+
+	return doProbeRequest(httpClient, req, http.StatusNotFound)
+}
+
 func probePostHog(
 	ctx context.Context,
 	httpClient *http.Client,