Restores a soft-deleted configuration.

Needed for scopes that don't determine reach on their own: Google's `drive.file` grants access to nothing except files Fruxon created or the user explicitly picked, so without this list such a connection can't touch a single pre-existing file. This mirrors a grant that actually lives at the provider — picking the file in the Picker is what grants it; this call records that it happened so the config page can show it and, later, so a tool call can pre-flight against it. Recording a resource here does <b>not</b> grant anything, and re-posting an existing id refreshes its stored name rather than erroring. Deliberately separate from the anonymous `oauth/authentication-completed` callback, which records the same fact from the mid-run OAuth redirect and is keyed on an encrypted flow token. This one is an authenticated operator action against a specific config.