[setup] Register the Jaah Lightspeed Retail OAuth

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Lightspeed needs a human sign-in. It lets members connect Lightspeed Retail to Jaah with one **Connect Lightspeed Retail** button. ## Steps 1. Sign in to Lightspeed Retail with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://cloud.lightspeedapp.com/oauth/register.php 2. Create a new OAuth app. Name it **Jaah**. 3. Under Integration Name enter Jaah, and under Website enter the public homepage of the company that runs this Jaah (its https address). 4. Under Redirect URI enter the prod redirect URI (listed below). The form takes one redirect URI per API client, and Lightspeed allows one API client per integration: register the dev redirect URI as a second integration named Jaah Dev with its own client. 5. Fill in Contact Person (name, email and phone of the account owner at Jaah), tick I agree to the Terms of Service and submit. 6. Copy the API client ID and secret the confirmation page shows. To change the redirect URI later, use the form's link for updating an existing API client. 7. Redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod) — one app per environment, doing the paste step below once per environment. 8. Request exactly this scope: `employee:all`. 9. Keep the client ID and secret in your password manager only until the next step is done. 10. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-lightspeed-app`, with provider `lightspeed`, the client ID and the client secret. 11. Open **Settings > Integrations > OAuth apps > Lightspeed Retail** and pick that secret in the knob `oauth_app.lightspeed`. 12. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `employee:all` | Act as the employee who connects, with that employee's rights, so agents can read and update items, inventory, sales and customers | ## Review or verification Not required: Lightspeed issues the client at once and it works for every Lightspeed Retail (R-Series) account. ## Runner validation On dev, **Connect Lightspeed Retail** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.