Harden Canadian legal connector reliability

[ranade-oss]

What changed

• require Canadian legal-research requests to begin with the legal-source search tool while preserving CourtListener's specialized US path
• persist provider-specific connector activity for later audit questions
• record per-provider success, failure, result count, and sanitized reason codes
• make A2AJ, Ontario e-Laws, and Justice Laws checks exercise production retrieval paths
• pass authorized per-user CanLII context into citation verification while keeping CanLII metadata-only and fail-closed

Root cause and impact

The beta did not enforce initial Canadian legal-source tool use, concealed provider-specific failures, omitted source events from later-turn context, and used health checks that did not exercise the production endpoints. This change makes Canadian connector execution auditable while preserving CourtListener and CanLII authorization boundaries.

Validation

• all 263 repository tests passed
• backend TypeScript build passed
• frontend production build passed
• changed frontend files passed targeted lint
• release manifest passed
• repository-wide strict lint retains the same 25 unrelated pre-existing errors