docs(api): publish POST /api/nightscout/connect

The route was exempt from the published contract as a browser handoff. It
is not one: Nightscout has no OAuth step and no authorise page, and the
route is an authenticated JSON POST that Zod-parses a URL and an optional
token, probes the instance and encrypts the pair onto the row. It was the
only POST among eight `connect` exemptions, and its three siblings —
status, test, disconnect — have been published all along, so a client
could read every part of the Nightscout flow except the one that starts
it.

Register it from `nightscoutConnectSchema` so the request shape stays
single-source, document the 400 / 413 / 422 / 429 arms the handler
actually answers with, and drop the exemption. Removing the registration
now fails the coverage guard by name.

docs/api/openapi.yaml

@@ -16633,6 +16633,57 @@ paths:
         "401": *a1
         "422": *a4
         "429": *a5
+  /api/nightscout/connect:
+    post:
+      tags:
+        - Integrations
+      summary: Connect (or update) the caller's Nightscout instance
+      description: Validates the URL and token with a live single-entry probe BEFORE storing anything, so a wrong token, an
+        unreachable instance or an unapproved private origin surfaces here rather than on the first cron tick. On
+        success the URL and token are encrypted at rest, the `nightscout` ledger is reset to connected, and a first sync
+        is enqueued best-effort. Re-sending replaces the stored values; there is no partial update. Body capped at 16
+        KiB, rate-limited 10 requests / 60 s per user. Auth via cookie or Bearer.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              $ref: "#/components/schemas/NightscoutConnectRequest"
+      responses:
+        "200":
+          description: The instance answered the probe and was stored.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/NightscoutConnectEnvelope"
+        "400":
+          description: Body is not parseable JSON.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
+        "401": *a1
+        "413":
+          description: Body exceeds 16 KiB.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
+        "422":
+          description: "The URL failed validation, the origin is private and the operator has not approved it (`meta.errorCode` =
+            `private_origin_not_approved` or `invalid_origin`), Nightscout rejected the token, or the instance could not
+            be reached. Nothing was written. The message is fixed per class and never the upstream error's own: a
+            Nightscout base URL carries its API token as a query parameter."
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
+        "429":
+          description: More than 10 connection attempts in 60 s from this user.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
   /api/nightscout/status:
     get:
       tags:
@@ -27443,6 +27494,26 @@ components:
         - entries
       description: Merge-by-`id` update of the HealthKit metric config. Unknown ids are silently ignored; omitted fields fall
         back to the stored (or default) value for that entry. Up to 50 entries per call.
+    NightscoutConnectRequest:
+      type: object
+      properties:
+        url:
+          type: string
+          minLength: 1
+          maxLength: 2048
+        token:
+          default: ""
+          type: string
+          maxLength: 512
+        allowPrivateHost:
+          default: false
+          type: boolean
+      required:
+        - url
+      description: "Instance URL and optional API token. Both are trimmed before use — a trailing space or newline from a copy
+        button reaches the instance verbatim and answers as an opaque DNS failure. `token` may be omitted or empty for a
+        fully public instance (`AUTH_DEFAULT_ROLES=readable`). `allowPrivateHost` is accepted for older clients and
+        ignored: only the server-side `NIGHTSCOUT_PRIVATE_ORIGINS` allowlist can authorise a private origin."
     WhoopCredentialsRequest:
       type: object
       properties:
@@ -62768,6 +62839,30 @@ components:
         - truncated
         - reasonCode
       additionalProperties: false
+    NightscoutConnectEnvelope:
+      type: object
+      properties:
+        data:
+          type: object
+          properties:
+            connected:
+              type: boolean
+              const: true
+          required:
+            - connected
+          additionalProperties: false
+        error:
+          type: "null"
+        meta:
+          type: object
+          properties:
+            requestId:
+              type: string
+          additionalProperties: false
+      required:
+        - data
+        - error
+      additionalProperties: false
     NightscoutStatusEnvelope:
       type: object
       properties: