Merge wave B — the connect step reads liveness, not a latched field

A provider with no sync history reports "unknown" instead of "connected",
so a fresh account is no longer told a device it never linked is already
delivering; the connect step resolves the sync verdict into four honest
tiles, records the flow's result only for a connection that is actually
serving, points an unconfigured provider at its credentials, and steps
over a source the account already has.

docs/api/openapi.yaml

@@ -64323,9 +64323,12 @@ components:
             - error_reauth
             - disconnected
             - parked
-          description: Last recorded ledger state for this provider. `connected` is also the value a user who has never synced
-            sees — the ledger row is created on the first attempt, and its absence reads as `connected`, not as an
-            error.
+            - unknown
+          description: "Last recorded ledger state for this provider. `unknown` (added v1.38.19) is what a user who has never
+            synced sees: the ledger row is created on the first attempt, and its absence is no claim about the
+            connection in either direction — it used to read as `connected`, which is why a client must never treat this
+            field as liveness. Read `syncHealth.verdict` for that, and treat `unknown` as `disconnected` anywhere a
+            ledger state is painted."
         lastSuccessAt:
           anyOf:
             - type: string
@@ -65318,9 +65321,12 @@ components:
             - error_reauth
             - disconnected
             - parked
-          description: Last recorded ledger state for this provider. `connected` is also the value a user who has never synced
-            sees — the ledger row is created on the first attempt, and its absence reads as `connected`, not as an
-            error.
+            - unknown
+          description: "Last recorded ledger state for this provider. `unknown` (added v1.38.19) is what a user who has never
+            synced sees: the ledger row is created on the first attempt, and its absence is no claim about the
+            connection in either direction — it used to read as `connected`, which is why a client must never treat this
+            field as liveness. Read `syncHealth.verdict` for that, and treat `unknown` as `disconnected` anywhere a
+            ledger state is painted."
         lastSuccessAt:
           anyOf:
             - type: string
@@ -65724,9 +65730,12 @@ components:
             - error_reauth
             - disconnected
             - parked
-          description: Last recorded ledger state for this provider. `connected` is also the value a user who has never synced
-            sees — the ledger row is created on the first attempt, and its absence reads as `connected`, not as an
-            error.
+            - unknown
+          description: "Last recorded ledger state for this provider. `unknown` (added v1.38.19) is what a user who has never
+            synced sees: the ledger row is created on the first attempt, and its absence is no claim about the
+            connection in either direction — it used to read as `connected`, which is why a client must never treat this
+            field as liveness. Read `syncHealth.verdict` for that, and treat `unknown` as `disconnected` anywhere a
+            ledger state is painted."
         lastSuccessAt:
           anyOf:
             - type: string