[matt-richardson]

Part of DPT-3630 (Renaming an Octopus space breaks TeamCity configurations that name it). Stacked on #261.

Why

The space picker needs to list the spaces on a connection's Octopus server, which means a server-side endpoint, /octopus/listSpaces.html. Nothing calls it yet; the picker UI comes in the next PR. This PR covers only connections that store their API key. Parameter-held keys and OIDC follow separately, and until then those connections get a message asking for the space name instead.

Security

The endpoint makes an outbound request on the caller's behalf, so it is deliberately narrow, and each point has a test:

• The caller must be logged in and hold EDIT_PROJECT on the project. That is the same permission needed to configure a connection at all, so it grants no reach they did not already have.
• The request only names a saved connection. It never supplies a URL or key, so the server only ever calls addresses an admin has already saved into project configuration. Posted serverUrl/apiKey values are ignored.
• The URL must be http(s) with a host, and redirects are not followed, so the key is never replayed elsewhere.
• The API key is never echoed back, and responses are Cache-Control: no-store.

A side effect of naming a saved connection: a brand-new connection must be saved once before its spaces can be listed. That's unavoidable anyway, because TeamCity renders a saved secret as a placeholder, so the browser never holds the real key.

Notes

The lookup uses HttpURLConnection and gson, following CommitHistoryFetcher, rather than com.octopus:octopus-sdk. The SDK is test-scope only today and would drag a gson upgrade into the shipped plugin.

🤖 Generated with Claude Code

[APErebus]

LGTM. Just 1 nit that might be worth fixing

[APErebus]

The `"Check the URL points at an Octopus server." is a slightly strange error message imo

[APErebus]

you might as well do int.MaxValue (or the java equivalent) so you just get all of them