Add MCP connector vendors to catalog

## Original requirement (verbatim, epic 13348) Deep research all third party integrations in Lovable (Connect) and implement all of them. Ensure the highest level of code reuse, abstract out any generic code across all integrations. Users need an easy way to connect. Documentation must be as detailed as in Lovable or better. If something needs to be done on the partner website (e.g. register an app) and it can only be done by human create a follow up task per third party with exact step by step of what user needs to do). Mark it as user only task to set up but the runner will validate it was done correctly. You can refactor anything to make working with creds more robust. ## Settled inputs Full PRD and architecture: the epic's `prd` and `architecture` artifacts (Task 13348 BA, Task 13349 Architect). Section numbers below refer to them. They are settled: realize them, do not reopen them. Operator decisions O1–O6 and D1–D8 bind. ## This child's scope Vendor wave W1-MCP (Chat MCP connectors), architecture §5 and §8. Vendors: Amplitude, Atlassian, Canva, Confidence, Excalidraw+, Granola, Hex, HeyGen, Linear, Loom (catalog alias of Atlassian Rovo), Miro, Notion, n8n, Polar, PostHog, Sanity, Sentry, Wispr Flow. Partner OAuth apps in this wave (need a human registration task, filed outside this child): Canva (pre-registered client), HeyGen (domain allow-list). DCR vendors need no registration task. Each spec carries `[mcp]` (url, url_editable, transport, auth oauth_dcr|oauth_registered|bearer_field:<key>|none). Hex and n8n take a tenant URL (url_editable). Every MCP vendor's Test is C4a's MCP tester (initialize + tools/list), mocked in unit tests; build no engine code here. For EACH vendor: the spec file `apps/api/app/integrations/vendors/<slug>.toml`, a sanitised logo, full `[docs]` prose including the MCP project-linking section, the slug appended to `EXPECTED.txt`, regenerated docs via `tools/integration_docs.py --write`, and one mocked unit test per vendor driving its connect path (DCR mocked, or bearer) plus its Test (pass + 401). Confirm each vendor's MCP URL, transport and auth from the vendor's OWN docs / `.well-known` metadata before writing its file and record the source URL in `vendor_docs_url`. Vendors in both an API wave and W1-MCP (Linear, Notion, Granola, n8n, PostHog, Sentry) are ONE file: whichever child lands first writes the full spec and prose; the other adds its block (`[mcp]` or `[[auth]]`) to the same file, never a second slug. Approach: data files only. Credentials & reach: - `org/console/dev-login` (generic_login) on https://app.dev.jaah.ai — verified (credential_get succeeded on node shared-a1d14391; HTTPS GET answered 200; the row's own base_url names a retired host, use app.dev.jaah.ai) - Live Test on dev for Stripe, n8n, Jira, AWS, GitHub, Figma: `me/jaah/debug/stripe-dev`, `org/n8n`, `org/atlassian`, `org/aws`, `me/users/roman@gmind.tech/github`, `me/figma` — verified (credential_get succeeded for each) - Live Test on dev for every other vendor — deferred: operator answer O6, "Unit tests only" - OAuth round trip on dev with Jaah-owned apps — deferred: D8 (the human registration tasks' validation sections run it later) - MCP on dev (linked project lists tools; transcript grep for the token) — deferred (MCP half): no MCP vendor or test-bearer credential exists, operator chose unit tests only (O6); proven by C4b unit tests. Console half verified via `org/console/dev-login` - Unit tests, `./dc check quick`, `tools/check_context.py` — verified (no credential) Out of scope (PRD §6, verbatim, plus what NOT to touch): - No app-user connectors (per-end-user OAuth, connector gateway for published apps). - No "Managed by Jaah" vendor keys or credit billing; no change to `apps/api/app/billing/`. - No per-vendor API client libraries or MCP tool wrappers built by Jaah (except where the vendor's own hosted MCP server is the connector). - No Lovable action-approval UI (allow once/always). - No change to runner auth to model providers (`account_auth.py`, `Account` table) or to login/sign-in OAuth (`routes/login_oauth.py`). - No change to NodeVault crypto semantics (`credential_crypto.py` encryption tiers) beyond what a refactor needs to keep behaviour identical. - Do not break existing rows: every existing credential type and every existing row keeps working; migrations additive (two-release overlap rule). - Supabase/project-backend and git-sync are not new work; Figma plugin/.fig upload out. - Never write a credential value into a task, doc, log or PR. - Do NOT file Tasks (no licence): the human-only OAuth registration tasks are filed outside this child. Done means: - AC4.1 The 18 chat MCP vendors and "Custom MCP server" are connectable (OAuth or key per vendor, server URL editable where the vendor allows, e.g. Hex tenant URL). — one unit test per MCP vendor driving its connect path (DCR mocked, or bearer) plus its Test; Hex and n8n accept an edited tenant URL, which is dialled through `vetted_addresses`. - AC3.1 / AC2.6 per vendor — each MCP vendor's mocked Test passes and its 401 case shows "<Vendor> rejected the token (401)". - AC6.1 One reader page per vendor in `apps/docs`, at least Lovable's depth, including MCP project linking. — `tools/integration_docs.py --check` green for every vendor in this wave AND the reviewer reads two generated pages and confirms real steps (no placeholder text, no empty section, >=2 troubleshooting entries). - AC2.1 count for this wave — the loaded slugs equal `EXPECTED.txt` and the six shared vendors appear once each with both chips. - AC8.1 for this wave: after merge+deploy, `GET /api/integrations` on app.dev.jaah.ai lists every slug of this wave with its `mcp` block; live MCP on dev deferred (O6). - R7 generator half for this wave: `--task-body` output for Canva and HeyGen uploaded with `artifact_upload` (`kind: "file"`, names `setup-canva.md`, `setup-heygen.md`) for the epic's Finish stage; the report lists them. - AC1.5 `./dc check quick` green and `tools/check_context.py` green on this PR — the gate output cited in the PR body.

Fixed lane failure on PR #7913: the jaah-ce mirror flagged a vendor brand in a catalog.py comment; reworded it. Mirror trees clean, CE + sensitive suites 98 passed, quick gate green. Queued to the lane; setup-canva/heygen.md uploaded. Memory: none applied.