feat: expose ingest sources through source index

[djwhitt]

Summary

• extend the existing GET /api/sources index to support ingest-compatible credentials
• preserve the full management response for private tokens and partner impersonation while returning only token and name for ingest credentials
• apply source-scope ownership filtering and add ordered RFC 4180 CSV through ?format=csv
• keep all source mutations and nested management actions private-scoped

Why reuse the existing endpoint

This alternative keeps source discovery at the established GET /api/sources URL instead of adding another API resource. Private management clients retain the current full JSON representation, while ingest credentials receive a restricted representation selected from the credential type. CSV is always the minimal token,name representation.

The tradeoff is that one route now has an authentication-dependent JSON schema and requires its index authorization to be separated from the remaining private source-management routes. The OpenAPI response documents both representations and focused tests cover the compatibility boundary.

This is an alternative to #3866; only one approach is intended to merge.

Testing

• ../bin/test test/logflare_web/controllers/api/source_discovery_controller_test.exs
• ../bin/test test/logflare_web/api_spec_test.exs test/logflare_web/open_api_test.exs
• MIX_ENV=test ../bin/format --check-formatted
• MIX_ENV=test ../bin/x mix lint.all
• ../bin/x mix compile

The existing full source_controller_test.exs has one PostgreSQL URL-redaction failure that is independently reproducible on the unchanged baseline.