fix(autoscan): address PR review findings

Codex and CodeRabbit review of #515. Each finding verified against the code
before acting; two were declined with reasons recorded below.

Correctness:
- source_config is plaintext JSONB returned verbatim by the source API, unlike
  connection keys which take the repository's encrypted path. Drop secret and
  PASSWORD fields from scan-source config forms rather than rendering a masked
  input over a value stored in the clear. Plugins needing a credential should
  take a connection.
- Plugin-declared webhook delivery is dropped at parse time. resolveDeliveryMode
  accepts webhook only for the built-in ARR identity, so honouring the claim
  offered a setup path whose every submission ended in HTTP 400. The built-in
  supplies its descriptor directly, so it is unaffected.
- Compat lookup now requires plugin id AND capability id. Capability ids are
  author-chosen and not unique, so an OR handed CephFS's path/exclusion form to
  any plugin naming a capability "cephfs".
- Config values stay typed until submit. Stringifying every change turned a
  false switch into the truthy "false" (re-rendering it enabled) and a
  multi-select array into a join the renderer read back as no selection.
- Creation is gated on config-form validity. The host stores source_config
  without interpreting it, so required and validated fields are only enforced
  client-side; the dialog previously ignored the renderer's verdict.
- Row editing now honours the descriptor it was already given: a `required`
  source cannot be unbound, a `none` source shows no picker, and only
  compatible connection kinds are offered.
- sourceTargets skips disabled libraries. The scanner rejects them, so counting
  one as a target showed a source as wired while its deliveries were dropped.
- Inline reuse compares request_integration_id, not connection id — different
  identifier spaces, so the dedupe matched nothing and could create a second
  connection to the same server. Disabled integrations are also excluded, since
  they are rejected at poll time.
- Webhook setup instructions follow the operator's chosen provider rather than
  the descriptor, which advertises both kinds and so always resolved to "auto".
- Webhook rows render their plugin-declared config form (the built-in's
  provider field stays with the endpoint section, not duplicated).

Declined:
- Collapsing sibling paths to a common ancestor is kept. It is what takes a
  real install's 96 library paths to 2 rows. The reviewer is right that one
  rule cannot serve branches the arr exposes under different roots, so the
  editor now offers to split a collapsed row into one row per branch
  (expandedRootsFor) instead of forcing the operator to retype paths.
- Legacy source_config keys are still migrated away on first save; the comment
  claiming both keys are written was wrong and has been corrected to match.

Also: stable ids on mapping rows so removing one does not throw focus into a
neighbouring field, memoized config fields, and descriptor marked optional in
the TS type to match descriptorFor's documented fallback.

web/src/api/types.ts

@@ -2135,7 +2135,8 @@ export interface AutoscanAvailableSource {
   capability_id: string;
   display_name: string;
   description?: string;
-  descriptor: AutoscanScanSourceDescriptor;
+  /** Optional: an older server omits it, and descriptorFor falls back. */
+  descriptor?: AutoscanScanSourceDescriptor;
 }
 
 export interface AutoscanAvailableSourcesResponse {