Choose the connection method with a radio group of choice cards

[kmcginnes]

Description

The connection method used to be a checkbox at the bottom of Advanced options, so the most consequential choice in the form was also the hardest to find, and the IAM fields appeared and vanished with nothing on screen explaining why. Direct connections are supported again as of #2369, so the form now presents both methods as a visible choice.

 <CreateConnection>
   Name
   Database URL
   Query Language
+  <ConnectionMethodField>                  "Connection method"
+    <MethodCard "Via proxy server">        selected by default
+      <IamSettings>                        Use AWS IAM authentication
+                                             AWS Region, Service Type
+    <MethodCard "Directly via browser">
   <Collapsible "Advanced options">
     Fetch Timeout
     Neighbor Expansion Limit
-    "Connect directly from the browser"    checkbox

• Each card carries one sentence on what that method supports and what it gives up. The whole card is a click target.
• The IAM settings sit in the proxy card, because only the proxy server can sign a request. Under "Directly via browser" they are hidden, and their values stay in the form but are not saved.
• Checking IAM states that the Graph Explorer server signs requests with its own AWS credentials, not yours.
• RadioGroup is a new primitive in src/components, wrapping the Radix radio group the way the other shadcn-derived components do.
• The error messages, the Database URL validation message, the docs, both decision records and the glossary follow the new wording.

Validation

Before: the method was a checkbox labelled "Connect directly from the browser" at the bottom of Advanced options, and the recovery messages told the reader to uncheck it there.

After:

New tests cover the default method, arrow-key selection, selecting by clicking a card, the signing notice, hiding and restoring the IAM settings, saving each method, the URL validation on the browser method, and editing a stored connection of either kind.

Verified live: exercised in Safari against a local dev server. Clicking a card's title, description, padding or corners selects it, arrow keys move between the cards, and the IAM controls inside the proxy card stay usable without changing the selection. An empty region blocks save, a relative URL on the browser method shows its validation message, and editing a saved direct connection opens on "Directly via browser" with Advanced options collapsed. The dialog logged no console errors.

Merge Danger

Door: two-way

Impact: connection form layout

Stored and exported connections keep their shape, so reverting needs no migration.

Related Issues

• Follows Stop describing direct connections as deprecated #2369
• Related to Simplify ConnectionConfig — remove url and proxyConnection #1622
• Related to Update form and validation logic in connections #1327
• Related to Simplify CreateConnection form UI #1625

Check List

• I confirm that my contribution is made under the terms of the Apache 2.0 license.
• I have verified pnpm checks passes with no errors.
• I have verified pnpm test passes with no failures.
• I have covered new added functionality with unit tests if necessary.
• I have updated documentation if necessary.

[kmcginnes]

Approved