Retire legacy connect paths and columns

## Original requirement (verbatim, epic 13348) Deep research all third party integrations in Lovable (Connect) and implement all of them. Ensure the highest level of code reuse, abstract out any generic code across all integrations. Users need an easy way to connect. Documentation must be as detailed as in Lovable or better. If something needs to be done on the partner website (e.g. register an app) and it can only be done by human create a follow up task per third party with exact step by step of what user needs to do). Mark it as user only task to set up but the runner will validate it was done correctly. You can refactor anything to make working with creds more robust. ## Settled inputs Full PRD and architecture: the epic's `prd` and `architecture` artifacts (Task 13348 BA, Task 13349 Architect). Section numbers below refer to them. They are settled: realize them, do not reopen them. Operator decisions O1–O6 and D1–D8 bind. ## This child's scope C19, architecture §6 release N+1, plus the legacy entry-point conversion moved here so no live entry point breaks before its catalog entry exists. - Drop `slack_installations.token_sealed` (and its check constraint) and `gmail_connections.sealed_secret`; remove the readers' fallbacks. - Remove the forge 307 start routes (`routes/forge_connect.py` / `routes/git_connect.py` starts) and stop writing `config.grant_dead_at`. - Convert `components/GitConnectionsCard.tsx` and `components/SlackWorkspaceCard.tsx` into thin links to the catalog Connect for their vendor (O3). Precondition: the Slack and Gmail migration children merged AND deployed to dev, and the operator console's system-activity record for both re-seal jobs shows pending = 0 on dev (read with `org/console/dev-login` on app.dev.jaah.ai). If not, do not merge; report it. Guarded drop (planner tightening): the migration fails closed: it raises and aborts the upgrade, with an actionable message, when any connected row still has a non-null legacy secret and a null `credential_id`. It never opens secrets itself. So a `develop`->`master` promotion carrying release N and N+1 together cannot destroy an un-adopted secret. Security/data surface: autonomous security review lane. Credentials & reach: - C19 precondition (legacy re-seal complete): the operator console's system-activity record via `org/console/dev-login` on app.dev.jaah.ai — verified reach; the record itself is created by C7 and C8 - `org/console/dev-login` (generic_login) on https://app.dev.jaah.ai — verified (credential_get succeeded on node shared-a1d14391; HTTPS GET answered 200; the row's own base_url names a retired host, use app.dev.jaah.ai) - Unit tests, `./dc check quick`, `tools/check_context.py` — verified (no credential) Out of scope (PRD §6, verbatim, plus what NOT to touch): - No app-user connectors (per-end-user OAuth, connector gateway for published apps). - No "Managed by Jaah" vendor keys or credit billing; no change to `apps/api/app/billing/`. - No per-vendor API client libraries or MCP tool wrappers built by Jaah (except where the vendor's own hosted MCP server is the connector). - No Lovable action-approval UI (allow once/always). - No change to runner auth to model providers (`account_auth.py`, `Account` table) or to login/sign-in OAuth (`routes/login_oauth.py`). - No change to NodeVault crypto semantics (`credential_crypto.py` encryption tiers) beyond what a refactor needs to keep behaviour identical. - Do not break existing rows: every existing credential type and every existing row keeps working; migrations additive (two-release overlap rule). - Supabase/project-backend and git-sync are not new work; Figma plugin/.fig upload out. - Never write a credential value into a task, doc, log or PR. - Do NOT file Tasks (no licence): the human-only OAuth registration tasks are filed outside this child. - Do NOT touch `slack_installations` routing columns, `gmail_connections` address/cursor columns, `user_git_connections` or `telegram_links`. Done means: - No-break: Slack and tenant Gmail keep working with the columns gone — unit tests: readers use the credential only; the migration aborts on a fixture with an un-adopted row and succeeds when all rows are adopted. - Precondition evidence: the dev system-activity record showing pending = 0 for both jobs, cited in the report. - `grep` finds no reader of `token_sealed` / `sealed_secret`, no forge 307 start route and no `grant_dead_at` write left in `apps/api/app`. - Legacy cards: on dev, the Slack and Git connection cards open the catalog Connect screen for their vendor — screenshot in the report. - AC2.1 end state: `EXPECTED.txt` lists exactly the 127 reconciled cards of architecture §8 (test asserts the count and the slugs), and the dev gallery Playwright count equals `GET /api/integrations` length equals 127 — cite the run. - AC1.5 `./dc check quick` green and `tools/check_context.py` green on this PR — the gate output cited in the PR body.