Build console integration gallery and Connect

## Original requirement (verbatim, epic 13348) Deep research all third party integrations in Lovable (Connect) and implement all of them. Ensure the highest level of code reuse, abstract out any generic code across all integrations. Users need an easy way to connect. Documentation must be as detailed as in Lovable or better. If something needs to be done on the partner website (e.g. register an app) and it can only be done by human create a follow up task per third party with exact step by step of what user needs to do). Mark it as user only task to set up but the runner will validate it was done correctly. You can refactor anything to make working with creds more robust. ## Settled inputs Full PRD and architecture: the epic's `prd` and `architecture` artifacts (Task 13348 BA, Task 13349 Architect). Section numbers below refer to them. They are settled: realize them, do not reopen them. Operator decisions O1–O6 and D1–D8 bind. ## This child's scope C2, architecture §3.3 plus the project MCP links tab. - `/credentials/new` with no `?type`/`?integration` renders the Gallery archetype (`ui/gallery/CardGrid` + `GalleryCard`, modelled on `pages/templates/TemplatesPage.tsx`): search by name or category, category chips, auth chip per card (OAuth, Key, MCP), connected state, "Docs" link to the reader page. Card names wrap, never clipped. No new sidebar item (O1). - `/credentials/new?integration=<slug>`: existing `CredentialEditPage` in create mode with integration header (logo, label, Docs link); method switch in `auth` order: "Connect <Vendor>" (disabled with "Jaah app not configured" when `app_configured=false` and no BYO entered), "Use an API key instead" (registry fields with `help`), "Use your own OAuth app" (client id + secret). Scope chooser = existing `OwnershipRadios` + project attach. - `/credentials/:id`: status pills (Connected, Test failed, Needs reconnect with Reconnect button, Untested), last test message and time; MCP tab for MCP-kind rows listing linked projects. - `ui/credentialMarks.tsx` falls back to the API logo URL before the monogram. - Leave `components/GitConnectionsCard.tsx` and `components/SlackWorkspaceCard.tsx` as they are (the final retirement child converts them once their catalog entries exist). - Project page MCP links tab: link, unlink, "Not supported by <agent>" when `supports_remote_mcp` is false (C4a routes). - Follow `docs/standards/ui-style-guide.md` and `docs/standards/ui-copy-standards.md`. While UI-testing, list itemized UX suggestions in the report; file nothing yourself. Credentials & reach: - `org/console/dev-login` (generic_login) on https://app.dev.jaah.ai — verified (credential_get succeeded on node shared-a1d14391; HTTPS GET answered 200; the row's own base_url names a retired host, use app.dev.jaah.ai) - Live Test on dev for Stripe, n8n, Jira, AWS, GitHub, Figma: `me/jaah/debug/stripe-dev`, `org/n8n`, `org/atlassian`, `org/aws`, `me/users/roman@gmind.tech/github`, `me/figma` — verified (credential_get succeeded for each) - OAuth round trip on dev with Jaah-owned apps — deferred: D8 (the human registration tasks' validation sections run it later) - Unit tests, `./dc check quick`, `tools/check_context.py` — verified (no credential) Out of scope (PRD §6, verbatim, plus what NOT to touch): - No app-user connectors (per-end-user OAuth, connector gateway for published apps). - No "Managed by Jaah" vendor keys or credit billing; no change to `apps/api/app/billing/`. - No per-vendor API client libraries or MCP tool wrappers built by Jaah (except where the vendor's own hosted MCP server is the connector). - No Lovable action-approval UI (allow once/always). - No change to runner auth to model providers (`account_auth.py`, `Account` table) or to login/sign-in OAuth (`routes/login_oauth.py`). - No change to NodeVault crypto semantics (`credential_crypto.py` encryption tiers) beyond what a refactor needs to keep behaviour identical. - Do not break existing rows: every existing credential type and every existing row keeps working; migrations additive (two-release overlap rule). - Supabase/project-backend and git-sync are not new work; Figma plugin/.fig upload out. - Never write a credential value into a task, doc, log or PR. - Do NOT file Tasks (no licence): the human-only OAuth registration tasks are filed outside this child. - No new sidebar item; do not convert the legacy Slack/Git cards here. Done means: - AC2.1 The console has one searchable, categorised integrations catalog listing every reconciled vendor with logo, name, category, auth method chip, and connected state. — dev browser (`org/console/dev-login`, app.dev.jaah.ai): search "snow" → Snowflake shows once W3a has landed (otherwise search a landed vendor and note it); filter category "CRM" → the landed CRM vendors show; Playwright card count = length of `GET /api/integrations` (= `EXPECTED.txt` for the landed waves). - AC2.2 Quality: vendor names never truncated; cards readable at 1280 px and phone width (390 px) with no horizontal page scroll; matches the ui-style-guide archetypes. — screenshots at 1280 px and 390 px attached to the report; reviewer confirms legible names, real logos (no broken images), no clipping, `document.scrollingElement.scrollWidth <= innerWidth` at 390 px. - AC2.3 (UI) OAuth vendor: one click "Connect <Vendor>" → consent → back with the connection saved and tested; BYO "Use your own OAuth app" runs the same flow. — component/e2e test with a mocked connect start; dev round trip deferred (D8). - AC2.4 Key vendor: the form shows only that vendor's fields, each with inline help naming where the vendor's UI shows it, and a link to the reader doc. — dev: open a key vendor (Stripe, using roster key `me/jaah/debug/stripe-dev`; Resend once W4 has landed), observe fields + help + doc link, save → "Connected" pill with the test message. - AC6.3 The catalog card and Connect screen link to the vendor's reader page. — dev: click "Docs" on a card → lands on that vendor's generated page. - AC7.2 (UI) Knob unset → card/Connect show "Jaah app not configured" and still offer BYO — component test. - AC4.3 (UI) Project MCP tab shows "Not supported by <agent>" for Antigravity/Pi — component test. - AC8.1 Catalog loads for an org member on dev with no flag off; key-vendor Connect + Test pass for the O6 roster vendors landed so far (Stripe, n8n, Jira, AWS, GitHub, Figma) — cite observed results. - AC1.5 `./dc check quick` green and `tools/check_context.py` green on this PR — the gate output cited in the PR body.