zendesk

Live-validates the subdomain/email/token triple with one real read (verify_credentials) before anything is persisted -- same discipline routers/github.py's connect_github applies to a PAT via verify_repo_access, so a typo'd subdomain or a revoked token fails immediately with a clear error instead of silently saving a connection the nightly sync will only discover is broken hours later.

Sync-status health surface -- last successful sync, last error, and this run's item/candidate counts. gnt status shows connector health for CLI-local connectors already; this is the server-side equivalent's own surface, a plain GET a future gnt status addition or the web dashboard can poll rather than anything pushed. Returns the same "never synced yet" zero-value shape regardless of whether Zendesk is even connected -- callers that care should check GET /v1/settings/zendesk's connected field first.