Connect/update-credentials endpoints validate the Flex token + query ID by
pulling a statement, then build pending accounts from it. Gated by a Pennant
feature (InteractiveBrokers, off by default) so it can be enabled per beta
tester until validated against a live account.
Credentials reuse the encrypted api_token (Flex token) and api_secret (Flex
query ID) columns, so no migration is needed.
f350fdde4f