Add custom REST and MCP connectors

## Original requirement (verbatim, epic 13348) Deep research all third party integrations in Lovable (Connect) and implement all of them. Ensure the highest level of code reuse, abstract out any generic code across all integrations. Users need an easy way to connect. Documentation must be as detailed as in Lovable or better. If something needs to be done on the partner website (e.g. register an app) and it can only be done by human create a follow up task per third party with exact step by step of what user needs to do). Mark it as user only task to set up but the runner will validate it was done correctly. You can refactor anything to make working with creds more robust. ## Settled inputs Full PRD and architecture: the epic's `prd` and `architecture` artifacts (Task 13348 BA, Task 13349 Architect). Section numbers below refer to them. They are settled: realize them, do not reopen them. Operator decisions O1–O6 and D1–D8 bind. ## This child's scope C5, architecture §4. - Table `custom_connectors` (org-scoped, standard entity shape per `docs/standards/coding-standards.md`; kind rest|mcp, base_url, auth_scheme bearer|header_key|basic|oauth2_client|none, header_name, value_prefix, oauth_authorize_url, oauth_token_url, oauth_scope, test_path, mcp_transport). The table already exists from C1's revision (no migration in this child). - `routes/integrations/custom.py` CRUD: Owners/Admins write, members read, every query org-filtered. - `GET /api/integrations` merges the caller's org custom connectors with `custom: true`, `category: custom`. - A connection is a credentials row of an existing generic type (`generic_api_key`, `generic_login`, `oauth2_client` with the `generic` provider, `mcp_server`) whose config carries `custom_connector_id`; Test dials `base_url + test_path` through `vetted_addresses` (MCP kind uses C4a's MCP tester). - Console: Gallery "Add custom" card (Custom connector, Custom MCP server) opening a define/detail page. - Generated reader docs for the two generic cards ("Custom connector", "Custom MCP server") via `tools/integration_docs.py`; both slugs appended to `EXPECTED.txt`. Security surface (authz): autonomous security review lane. Credentials & reach: - `org/console/dev-login` (generic_login) on https://app.dev.jaah.ai — verified (credential_get succeeded on node shared-a1d14391; HTTPS GET answered 200; the row's own base_url names a retired host, use app.dev.jaah.ai) - Unit tests, `./dc check quick`, `tools/check_context.py` — verified (no credential) Out of scope (PRD §6, verbatim, plus what NOT to touch): - No app-user connectors (per-end-user OAuth, connector gateway for published apps). - No "Managed by Jaah" vendor keys or credit billing; no change to `apps/api/app/billing/`. - No per-vendor API client libraries or MCP tool wrappers built by Jaah (except where the vendor's own hosted MCP server is the connector). - No Lovable action-approval UI (allow once/always). - No change to runner auth to model providers (`account_auth.py`, `Account` table) or to login/sign-in OAuth (`routes/login_oauth.py`). - No change to NodeVault crypto semantics (`credential_crypto.py` encryption tiers) beyond what a refactor needs to keep behaviour identical. - Do not break existing rows: every existing credential type and every existing row keeps working; migrations additive (two-release overlap rule). - Supabase/project-backend and git-sync are not new work; Figma plugin/.fig upload out. - Never write a credential value into a task, doc, log or PR. - Do NOT file Tasks (no licence): the human-only OAuth registration tasks are filed outside this child. - No new credential tester or runner contract (reuse the generic types). Done means: - AC5.1 An org admin defines a REST connector (name, base URL, auth scheme: bearer / header key / basic / OAuth2 client, optional test path); it appears in that org's catalog for all members and is usable like a built-in. — unit tests per auth scheme (define → listed for a member → connect → Test against a mocked endpoint → runner `credential_get` returns the fields); dev: define one pointing at a public echo endpoint, see it in the gallery, connect, Test passes. - AC5.2 Custom connectors are org-private: another org never sees them. — authz unit test (other org: list excludes it, GET/PUT/DELETE → 404; member cannot write → 403). - AC4.1 (Custom MCP server) connectable with URL and optional bearer/OAuth — unit test. - AC6.1 for the two generic cards — `tools/integration_docs.py --check` green for both. - SSRF: a custom base_url of 169.254.169.254 or an RFC 1918 address is refused — unit test. - AC1.5 `./dc check quick` green and `tools/check_context.py` green on this PR — the gate output cited in the PR body.