fix(tests): handle the refused provider expansion before awaiting the concurrent grant

The concurrent-grant test started ensureWorkspaceAccountsGroup and awaited
the grant transaction before attaching a handler to the refusal. When the
refusal resolved first, Node reported an unhandled rejection and Vitest failed
the shard although the test passed. Attach the rejection assertion when the
call starts and await it after the grant commits.

Author: waleedlatif1

apps/sim/lib/knowledge/__integration__/search-source-setup.integration.ts

@@ -492,14 +492,17 @@ describe('Search source identity and concurrent creation', () => {
         .where(eq(resourcePolicy.resourceId, searchGroupId))
     })
     await locked
-    const append = ensureWorkspaceAccountsGroup(ids.workspaceId, ids.aliceId, {
-      provider: 'jira',
-      label: 'Jira',
-      required: false,
-    })
+    /** Handled from the start: the refusal can land before the grant's commit resolves here. */
+    const refused = expect(
+      ensureWorkspaceAccountsGroup(ids.workspaceId, ids.aliceId, {
+        provider: 'jira',
+        label: 'Jira',
+        required: false,
+      })
+    ).rejects.toThrow('has workflow access')
     releaseGrant()
     await grant
-    await expect(append).rejects.toThrow('has workflow access')
+    await refused
     const existing = await ensureWorkspaceAccountsGroup(ids.workspaceId, ids.aliceId, {
       provider: 'google-drive',
       label: 'Google Drive',