[datlechin]

Summary

• Pre-connect script gets TABLEPRO_CONNECTION_NAME, TABLEPRO_HOST, TABLEPRO_PORT, TABLEPRO_USER, TABLEPRO_DATABASE. Never the password. Host and port are the typed ones, not a tunnel's loopback.
• Script timeout field: 10 s default, 1 to 300.
• Post-Disconnect Script: runs once when a session whose pre-connect script ran ends (Disconnect, window close, quit, failed connect). Shown and approved with the pre-connect script, logged on failure, stripped from links and exports. The next connect waits for a running cleanup.
• Password command: {host}, {port}, {user}, {database} become quoted references to the same TABLEPRO_* variables, which are exported too, so a value is never parsed as code.
• Password command reuse: reuseSeconds in connections.json, Reuse Result For in the profile editor. In memory only, dropped on a failed connect.
• Redshift AWS IAM sign-in (Access Key, Profile, SSO): GetClusterCredentialsWithIAM, or GetClusterCredentials when Username is set; Serverless uses GetCredentials. The returned user and password sign in, Backup Dump included. The endpoint comes from Host (exact AWS names only) or Redshift Endpoint behind a port forward.
• Scripts get the Homebrew and /usr/local/bin paths a Dock launch lacks, stop with their process group on timeout or cancel, and a self-signal is a failure, not a timeout.
• The script that runs is the text consent showed: $VAR is left to bash instead of being expanded from TablePro's environment first.
• RegistryAWSIAMFieldsTests.excludedTypesHaveNoIAM pinned "Redshift has no IAM"; Redshift now has its own test there.

Test plan

• New suites: ConnectionScriptContextTests, ConnectionScriptRunnerTests, PostDisconnectScriptsTests, RedshiftIAMSignInTests (SigV4 signature checked against an independent computation). New cases in PreConnectScriptEntryPointTests, PreConnectScriptConsentTests, PasswordSourceResolverTests, PasswordSourceCodableTests, ShareableAdditionalFieldsTests.
• 233 cases in the affected suites, TableProImportTests and IOSConnectionExportServiceTests pass. Lint, l10n and docs checks pass.
• Docs: docs(connections): connection scripts, script variables, Redshift IAM docs#72

Fixes #2498
Fixes #2494