[setup] Register the Jaah Linear OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Linear needs a human sign-in at Linear. It lets members connect Linear to Jaah with one **Connect Linear** button. ## Steps 1. Sign in to Linear with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://linear.app/settings/api/applications/new 2. Create a new OAuth app. Name it **Jaah**. 3. Do this in a dedicated Linear workspace owned by the company: every admin of the workspace that owns the app can see and edit it. 4. In Settings > API > OAuth applications select Create new (the console URL above opens the form directly). 5. Fill in Application name Jaah, Developer name Jaah, the Jaah website as Developer URL, and a one-line description. 6. Under Callback URLs add the redirect URLs below, one per line. 7. Turn on Public so members of every Linear workspace can authorize the app, and leave Client credentials off. 8. Upload the Jaah logo as the application icon, then select Create. 9. Add both redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 10. Request exactly these scopes: `read`, `issues:create`, `comments:create`, `write`. 11. Copy the app's client ID and client secret. Keep them in your password manager only until the next step is done. 12. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-linear-app`, with provider `linear`, the client ID and the client secret. 13. Open **Settings > Integrations > OAuth apps > Linear** and pick that secret in the knob `oauth_app.linear`. 14. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `read` | Read issues, projects, cycles, teams and comments, and see whose account is connected | | `issues:create` | Create issues when an agent finds follow-up work | | `comments:create` | Comment on issues with progress and pull request links | | `write` | Update issues: change status, assignee, labels and fields when work is done | ## Review or verification Not required: a public Linear OAuth application works for any workspace as soon as it is created. ## Runner validation On dev, **Connect Linear** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.