[setup] Register the Jaah Notion OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Notion needs a human sign-in. It lets members connect Notion to Jaah with one **Connect Notion** button. ## Steps 1. Sign in to Notion with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://www.notion.so/profile/integrations 2. Create a new OAuth app. Name it **Jaah**. 3. Select New integration, choose the workspace that should own it, and set Type to Public. 4. Fill in Integration name Jaah, upload the Jaah logo, and add the company name, website, privacy policy and terms of use URLs Notion asks for. 5. Under OAuth Domain & URIs add the redirect URIs below. 6. Select Save, then open the Capabilities tab: tick Read content, Update content, Insert content and Read comments, and Read user information including email addresses, then Save changes. 7. Open the Configuration tab to find the OAuth client ID and client secret. 8. Redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 9. Capabilities (set on the app itself): `Read content`, `Update content`, `Insert content`, `Read comments`, `Read user information including email addresses`. 10. Copy the app's client ID and client secret. Keep them in your password manager only until the next step is done. 11. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-notion-app`, with provider `notion`, the client ID and the client secret. 12. Open **Settings > Integrations > OAuth apps > Notion** and pick that secret in the knob `oauth_app.notion`. 13. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Capability | Why Jaah asks for it | |---|---| | `Read content` | Search and read the pages and databases the member shares with Jaah | | `Update content` | Edit those pages and database entries when a task asks | | `Insert content` | Add pages, blocks and database entries | | `Read comments` | Read discussion on a page for context | | `Read user information including email addresses` | Show whose workspace the connection reaches | ## Review or verification Not required to let any workspace connect. Listing Jaah in Notion's Integrations gallery is optional and is a separate submission. ## Runner validation On dev, **Connect Notion** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.