Note

Medium Risk
Touches authentication and all Phrase translation API calls via a new client path; OAuth/session edge cases (org switch, stale metadata, token expiry) need correct behavior in production.

Overview
Adds SSO / OAuth 2.0 as an alternative to username/password for the Phrase connector, with settings for auth mode, per-org OAuth Client ID, and a Connect / Disconnect panel that runs the Builder API popup flow (prepare → start → postMessage). Access tokens stay on the server; the browser only tracks connection metadata plus apiKey-scoped session markers for connect/disconnect before org settings reload.

Replaces the direct Phrase client with PhraseApi, which calls /api/v1/memsource/* with the plugin private key, runs ensureAuthenticated for Translate/Apply, and retries after oauth/refresh on 401 in OAuth mode. Username/password fields are hidden when OAuth is selected; both credential types can coexist when switching modes.

README documents OAuth setup (redirect URI, US data center, sequence diagram). Package version bumps to 0.0.17-1; the stub Request an updated translation content action is removed while translation freshness checking is refactored into checkTranslationFreshness.

^{Reviewed by Cursor Bugbot for commit 7abd3c7. Bugbot is set up for automated code reviews on this repo. Configure here.}