Credential-free view of a stored OAuth connection.
Carries identity and lifecycle fields only. Omits tokens, client secrets,
raw provider payloads, provider configuration, and retry state. A read does
not refresh tokens or take locks, and an :active status does not promise
the access token is still usable or unchanged.