eeBUS AdminV1: reject query strings on specialized Connect

[d3vi1]

Context

Fresh exact-HEAD review of PR #849 identified one nonblocking hardening gap: the specialized eeBUS Connect dispatch executes before the common RawQuery rejection, so a query-bearing Connect URL is accepted and the query is ignored.

Scope

Reject non-empty request.URL.RawQuery inside the specialized Connect handler before any capability lookup, idempotency reservation, audit, or backend effect.

Acceptance criteria

• RED-first regression for a query-bearing Connect request.
• Response is a sanitized closed client error with zero backend calls and zero secret retention.
• Query-free Connect behavior and the eeBUS: deliver PIN-safe Portal action tracking #849 PIN/idempotency/audit contract remain unchanged.
• Focused normal/race and repository CI pass.

Disposition

P3 backlog from PR #849 fresh review; nonblocking for #848 closure.