feat(webapp): GitLab workspace admin settings (connection, webhook, token management)

[FelixTJDietrich]

Context

Split from #936 (GitLab login). After creating a GitLab workspace and configuring login (#936), admins need UI to manage GitLab-specific settings: connection health, webhook status, monitored projects, and token lifecycle.

Previously tracked as #725 (closed, scope absorbed here).

Scope

1. Connection Status Section

• Token validity indicator: Valid / Expiring Soon / Invalid
• Last successful API call timestamp
• GitLab instance URL (read-only)
• "Test Connection" button

2. Webhook Health Section

• Status: Receiving / Stale (>24h) / Never Received
• Last webhook timestamp
• Manual setup instructions with copyable URL/secret (if auto-registration failed)

3. Monitored Projects Section

• List of monitored GitLab projects with sync status
• Add/remove project controls
• Uses existing WorkspaceRepositoryMonitorService endpoints

4. Token Management Section

• Update PAT with expiration warning
• Uses existing PATCH /token endpoint

UI Conventions

• Follow existing AdminSettingsPage composition pattern: props bundle per section
• Each section: <Card><CardContent>...</CardContent></Card>
• Named function exports, export interface SectionNameProps
• Container/presentational split: admin route fetches, sections are presentational
• Destructive actions guarded by <AlertDialog>
• <Skeleton> for loading, toast.error() for errors
• Storybook for each section + composed page:
  • CSF3, satisfies Meta, tags: ["autodocs"], fn() for callbacks
  • Stories: Default, TokenExpiringSoon, WebhookStale, NoProjects, Loading

Verification

• Connection status accurately reflects token validity
• Webhook health shows correct status
• Project add/remove works
• Token update works with expiration display
• All section stories render correctly in Storybook

Dependencies

• Blocked by feat(webapp,application-server): GitLab login via Keycloak OIDC + multi-provider landing page #936 (GitLab login must work first)