Clio train: composed-range fix wave

Address the six findings from the composed-range multi-lens review of the
Clio connector train (PRs 2/3 + policy-exemption), plus one stale-comment nit.

1. SAR completeness (#52 pattern): buildUserAccountExport gains a token-free
   clio_connections section via getClioConnectionMetadata (allowlist re-projection,
   42P01/42703-tolerant) - never any encrypted/token material.
2. Account deletion best-effort revokes each connected Clio grant
   (revokeAllClioGrants) before auth.admin.deleteUser; failures never block delete.
3. Connect-flow timeout re-checks /clio/status once before declaring failure,
   so a slow-but-successful connect self-heals; honest fixed message otherwise.
4. A refresh rejected as invalid_grant prunes the dead connection row so the
   stale connected pill self-heals; transient/network failures never prune.
5. Policy-OFF connectors page: page-level "Connectors" heading now sits above
   the Clio card (FirmManagedCard heading made optional).
6. BUILD_LOG: add the missing --- between the PR 3 and PR 2 entries.

Also correct client.test.ts's stale "5s cap" comment to 3s (MAX_RETRY_AFTER_MS).

Backend tsc clean, vitest 600/600 (589 baseline + 11 new). Frontend tsc clean,
ESLint clean on changed files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>