Refactor access review campaign source API

Expose campaign sources as first-class nodes, paginate fetch attempts
instead of denormalized status fields, and bind entries to their
campaign snapshot. Update GraphQL, MCP, CLI, console, and e2e coverage
to match.

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/mcp/v1/specification.yaml

@@ -7851,15 +7851,13 @@ components:
 
     ListAccessEntriesInput:
       type: object
-      required:
-        - campaign_id
       properties:
         campaign_id:
           $ref: "#/components/schemas/GID"
-          description: Campaign ID
+          description: Campaign ID. Required when access_review_campaign_source_id is omitted.
         access_review_campaign_source_id:
           $ref: "#/components/schemas/GID"
-          description: Filter by per-campaign source snapshot ID
+          description: Campaign source snapshot ID. When set, lists entries for that source only and campaign_id is ignored.
         order_by:
           $ref: "#/components/schemas/AccessReviewEntryOrderBy"
           description: Order by
@@ -8026,15 +8024,6 @@ components:
         campaign:
           $ref: "#/components/schemas/AccessReviewCampaign"
 
-    AccessReviewSourceCategory:
-      type: string
-      go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.AccessReviewSourceCategory
-      enum:
-        - SAAS
-        - CLOUD_INFRA
-        - SOURCE_CODE
-        - OTHER
-
     AccessReviewSourceOrderField:
       type: string
       go.probo.inc/mcpgen/type: go.probo.inc/probo/pkg/coredata.AccessReviewSourceOrderField