[TheGreatAxios]

Summary

• CL-7593: shrink step for @corbits/connections toward the PKCE OAuth client + callback surface.
• Deletes the one-time CL-7242 duplicate-grant cleanup (module, DB-gated test, export-map subpath); its era is over — repo_review_lease prevents new duplicates at write time.
• scripts/db-setup.ts now applies migrations only; grant state stays on the native grant routes.
• Adds a shrink-guard test pinning the entry point's absence (module file + export map).
• Remaining shrink surface (credential stores, parallel-login lease, non-PKCE flows) still has live callers in fenced/product areas; left for follow-up caller-migration lanes.

Verification

• RED: connections-shrink.test.ts failed before the deletion (1 fail), passes after.
• bun test packages/connections: 396 pass, 0 fail.
• packages/connections typecheck (tsc --noEmit): clean.
• Repo typecheck (bun run typecheck): exit 0.
• prettier --check + eslint on changed files: clean.
• bun run check:structural: ok.
• Grep for reconcileDuplicateRepoGrants|reconcile-duplicate-repo-grants: zero hits outside the guard test's absence assertions.

Fixes CL-7593

[linear-code]

CL-7593