fix(connection): report each connection's access from the key's rules on One (v2.4.0)

[krish221997]

Problem

one list built each connection's access only from local one config settings. The per-app access set on the consent page or dashboard lives on One, so every connection showed {"policy":"full"} even when the key was read-only or limited to specific actions. Agents then planned writes that failed with 403.

Fix

• one list reads the calling key's enforced rules live on every call from GET /v1/access/self (withoneai/pica-v2#903), so dashboard edits show up immediately.
• Rules are matched the way One enforces them (EventAccessConnection::is_allowed): no rules means global methods only; with rules, a connection no rule names reaches nothing; a rule's methods override the global ones; actionIds narrow to those actions; methods are judged by the action's CRUD verb (envelopeMethod), so a POST-sent read counts as GET. A method list covering every CRUD verb (the dashboard's "Full access") reads as full.
• Local one config settings still apply, only ever narrowing.
• If the rules can't be read (older API without /v1/access/self, network error, malformed body), every connection reports the new {"policy":"unknown"} with an accessError explaining why. It never falls back to full.
• Docs updated: README, skills/one/SKILL.md, one guide, and one list --help. Version bumped to 2.4.0 (minor), since policy: "unknown" and accessError are new output.

Verified

Against production, with the access response for a real key that has read/write Google Calendar, read-only Gmail and one Stripe action:

google-calendar {"policy":"methods","methods":["GET","POST","PUT","PATCH"]}
gmail           {"policy":"methods","methods":["GET"]}
stripe          {"policy":"actions","actions":[{"actionId":"conn_mod_def::GJ7KswBYlCw::BN6om4mlSIeedATrlfjvbA","title":"List Invoices","method":"GET"}]}

Notes

• Release after withoneai/pica-v2#903 is deployed. Before that, one list reports unknown (with the reason) rather than full.
• 6 resolveConfig tests in src/lib/config.test.ts fail locally on unmodified main too. They're unrelated to this change.

🤖 Generated with Claude Code