[setup] Register the Jaah Pipedrive OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Pipedrive needs a human sign-in. It lets members connect Pipedrive to Jaah with one **Connect Pipedrive** button. ## Steps 1. Sign in to Pipedrive with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://developers.pipedrive.com/ 2. Create a new OAuth app. Name it **Jaah**. 3. The owning account must be a Pipedrive developer sandbox account: create one from Start here on the developer site if there is none, and sign in to it. 4. To create the app, open the account menu at the top right, select Developer Hub, then Create an app and choose Create private app. 5. On Basic info enter App name Jaah; the Callback URL is the redirect URI below. 6. On OAuth & access scopes tick Deals: Full access, Activities: Full access, Contacts: Full access, Leads: Full access, Search for all data and Users: Read only (Basic access is always on). 7. Select Save, then copy the Client ID and Client secret shown under OAuth & access scopes. 8. Redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). If Pipedrive allows only one per app, create a second app named **Jaah** for dev and do the paste steps once per environment. 9. Keep the client ID and secret in your password manager only until the next step is done. 10. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-pipedrive-app`, with provider `pipedrive`, the client ID and the client secret. 11. Open **Settings > Integrations > OAuth apps > Pipedrive** and pick that secret in the knob `oauth_app.pipedrive`. 12. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why Jaah names no scopes on the sign-in request: Pipedrive grants the access set on Jaah's app itself (step 6), and lists it on its approval screen. ## Review or verification Pipedrive must approve the public app (Marketplace review, listed or unlisted) before companies other than the developer sandbox can install it. ## Runner validation On dev, **Connect Pipedrive** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.