Scope tool policies to the account they are set under

[RhysSullivan]

On the integration Tools tab, a policy set from a row inside an account section used to write a connection-wildcarded pattern (integration.*.*.tool). With two connections of one integration, blocking a tool under one account blocked it under the other too.

• Rows inside an account section now write integration.<owner>.<connection>.tool; category rows write integration.<owner>.<connection>.group.*.
• Each account header gets a menu that sets a rule for the whole connection (integration.<owner>.<connection>.*).
• The tool detail badge uses the same account-pinned pattern, so it recognizes its own rule.
• Members no longer see policy menus they cannot use. The server refuses org policy writes from non-admins.
• messageFromExit now reads message from error instances whose message is a getter, so a refused write shows the server's reason instead of a generic failure. The duplicate decoder in integration-add.tsx reuses it.

The flat Tools page keeps the connection-agnostic form.

Verified: react unit tests, policies-ui and selfhost integration-creation-permissions e2e scenarios.

[github-actions]

Cloudflare preview

Torn down — the PR is closed.