naive.toolkits is a control-plane accessor: it lists the catalog of apps a tenant could
connect. Root client only — there is no forUser(id).toolkits, because the catalog is the
same for every tenant; what differs is which entries their Account Kit allows.
To act on a connected app for one tenant — list connections, start OAuth, enumerate an
app’s tools, execute one — use connections, which is
tenant-scoped and filtered by that tenant’s kit. Which toolkits a kit permits is set by
connections_config on the Account Kit.