[setup] Register the Jaah Scrive OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Scrive needs a human sign-in (or a request to Scrive support). It lets members connect Scrive to Jaah with one **Connect Scrive** button. ## Steps 1. Sign in to Scrive with the account that should own Jaah's app (a shared company account, never a personal one), and open: https://scrive.com/new/integrations 2. Create a new OAuth app. Name it **Jaah**. 3. Scrive's form lives under Integration settings (scrive.com/new/integrations) for a company admin. If it shows no OAuth 2.0 clients section, ask Scrive support or your account manager to register the client instead, giving them the name Jaah, both redirect URIs and the scopes below, and wait for the client ID and secret they send. 4. Scrive calls the redirect URI the callback URL. Use exactly: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). If Scrive allows only one per client, register a second client named **Jaah** for dev and do the paste steps once per environment. 5. Request exactly these scopes: `doc:check`, `doc:create`, `doc:send`, `offline_access`. 6. Keep the client ID and secret in your password manager only until the next step is done. 7. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-scrive-app`, with provider `scrive`, the client ID and the client secret. 8. Open **Settings > Integrations > OAuth apps > Scrive** and pick that secret in the knob `oauth_app.scrive`. 9. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `doc:check` | Agents check who has signed, read document details and download signed files | | `doc:create` | Agents prepare documents from a PDF or template and add the signing parties | | `doc:send` | Agents send a prepared document out for signature | | `offline_access` | Lets Jaah renew the one-hour access token, so you do not sign in again every hour | ## Review or verification Scrive registers OAuth 2.0 clients per client name, callback URL and scopes; its API documentation describes no public app review. ## Runner validation On dev, **Connect Scrive** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.