BOLT-1988: backend manufacturerSlug allowlist guard on WorkspaceSystemConnection write

Follow-up to PR #14936 (UI half). Add server-side validation of manufacturerSlug against the device manufacturer catalog at the write site. Anchor: domains/connect/subgraph/src/services/workspaceSystemConnection/index.ts addWorkspaceSystemConnection() — literal // TODO: Validate these parameters are legit sits at the tx.workspaceSystemConnection.create data block. Also cover the CSV/bulk-import path (domains/connect/subgraph/src/commands/manufacturer-credential-bulk-import). Needs: (a) a supergraph-client query to device manufacturers/manufacturerBySlug (pattern: supergraph-client/queries/getCustomerDevices.ts), (b) a reject-vs-bucket policy decision (ARCHITECTURAL — ask Slava: hard-reject unknown slugs on write, or persist + flag?), (c) caching so the catalog fetch does not hammer the write hot-path. Deferred from same-session because it needs cross-service type-gen + Slava policy call, not blind-shippable.