Support query-parameter auth (refs #5) - #6

Refs #5.

Mirrors query-parameter auth from superfly/sprites-api#1574 into the manifest format, the probe runner and the contributor guide. A connector may now declare

"auth": {"query": "token"}

Depends on sprites-api PR superfly/sprites-api#1574 being released. The format and tooling accept the form today, but a query-auth connector (Pushover) cannot ship from this repository until the gateway that understands it is live.

What changed

• v1/schema.json: copied from priv/connectors/schema.json on the sprites-api branch. The auth definition gains the {"query": name} object (name matching ^[^\s=&%]+$) and descriptions. The copy here had also fallen behind sprites-api main, so the same diff brings in examples being required with at least one entry, the probe.expect-or-hooks rule, and the tier, owner and source_url fields. Every example, the Notion connector and the template validate against it.
• scripts/lib/credential.mjs (new): the key placement shared by the runner and the checks. For the query form it strips every parameter of that name from the query string (keys decoded for the comparison, so %74oken counts; other pairs keep the caller's encoding) and appends name=<key> x-www-form-urlencoded. Also redactText / holdsKey, which cover the key as typed and URL-encoded.
• scripts/probe.mjs: honours auth.query; sends no credential header for it; redirects stay off and there are still no retries. The request line it prints, every error and the written fixture pass through redaction, so neither the raw nor the encoded key appears, including when the API echoes the request URL in a body or header. The command body moved into an exported run(argv, {root, env, log, error}) so it can be tested end to end on a sandbox root; the CLI behaviour and exit codes are unchanged.
• scripts/lib/manifest.mjs: manifestProblems reports an auth that is not one of the three forms in words, so check-connectors.mjs says what is wrong without ajv.
• Tests: scripts/test/credential.test.mjs (the gateway's own query-string, encoding and redaction cases), query-auth cases in probe.test.mjs against the local http.createServer stub (the server sees exactly one token parameter with the key although the probe path carried token=wrong, no Authorization header, and neither the printed output nor the written fixture holds the key raw or encoded, also on a transport error), and an auth case in manifest.test.mjs. 47 tests pass on Node 22.
• CONTRIBUTING.md: documents {"query": "token"}, that Sprites replaces any parameter of that name the Sprite sends rather than appending, that the key then appears in the request URL so the connector's notices should say so, and that connectors whose API echoes request URLs in error bodies set gateway_error_messages to false. The "cannot do" list now reads bearer token, fixed header or query parameter.
• Not changed: v1/vectors.json has no auth cases; the template does not explain auth, so it was left alone.

Checks run

• node --test "scripts/test/*.test.mjs": 47 pass
• node scripts/check-connectors.mjs: 12 connector(s) ok
• the workflow's ajv step over examples/*, connectors/* and the template: all valid