Allow closing access reviews when a connector fetch fails

[gearnode]

Summary

Fixes ENG-661: reviewers could finish every reachable account decision but still could not complete a campaign when one connector/source fetch failed.

• Backend: CloseCampaign ignores pending decisions on campaign sources whose latest fetch attempt is FAILED, so a broken connector no longer blocks closure after successful sources are reviewed.
• Worker: Every failed fetch attempt now runs campaign lifecycle finalization (not only FetchSource errors), and a campaign moves to PENDING_ACTIONS only when each campaign source has a latest fetch attempt and all of those are terminal.
• Console: The Complete campaign button uses the same pending-count rule as the API, and the detail page refreshes while PENDING_ACTIONS so pending counts stay in sync after decisions.

Test plan

• Start a campaign with multiple sources; force one connector fetch to fail and complete decisions on the others → Complete campaign succeeds.
• Regression: campaign with all sources succeeding still requires every pending entry to be decided before close.
• go test ./pkg/accessreview/... (integration test TestCloseCampaign_IgnoresPendingOnFailedSourceFetch when Postgres is available)

Linear Issue: ENG-661

  

---

Summary by cubic

Allows closing access review campaigns even if a connector fetch failed, by ignoring pending decisions on those failed sources. Addresses ENG-661 so API, worker, and console use the same rule.

Service +161 -22

• CloseCampaign subtracts pending entries from sources whose latest fetch is FAILED (via countPendingEntriesBlockingClose).
• Worker finalizes the campaign after any failed fetch attempt and moves to PENDING_ACTIONS only when every source has a latest attempt.
• Adds failAttemptAndFinalizeCampaign and loadCampaignIDForCampaignSource to handle failures more reliably.

App: console +51 -3

• Adds countPendingEntriesBlockingClose to mirror backend logic for pending counts.
• CampaignDetailPage enables Complete only when blocking pending count is zero and auto-refreshes while PENDING_ACTIONS.

Tests +259 -0

• Adds TestCloseCampaign_IgnoresPendingOnFailedSourceFetch to verify pending entries on failed sources do not block close.

^{Written for commit e4b877b. Summary will update on new commits.}