[setup] Register the Jaah Wave OAuth app

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Wave needs a human sign-in. It lets members connect Wave to Jaah with one **Connect Wave** button. ## Steps 1. Sign in to Wave with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer portal: https://developer.waveapps.com/hc/en-us 2. Create a new OAuth app. Name it **Jaah**. 3. Open Manage Applications from the developer portal's menu and select Create an application. 4. Under Name enter Jaah and under Description enter: Lets the AI agents working Jaah tasks read and draft invoices, customers and transactions. 5. Under Redirect URIs enter both, one per line: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 6. Save, then open the application and copy its Client ID and Client Secret. Keep them in your password manager only until the steps below are done. 7. To connect businesses other than the app owner's own, apply to Wave for production access from the application's page; until Wave approves it, only the owner's businesses can connect. 8. Scopes requested at sign-in: `user:read`, `business:read`, `customer:*`, `invoice:*`, `product:*`, `account:read`, `transaction:*`. 9. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-wave-app`, with provider `wave`, the client ID and the client secret. 10. Open **Settings > Integrations > OAuth apps > Wave** and pick that secret in the knob `oauth_app.wave`. 11. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `user:read` | Read who connected, so Test can name the account | | `business:read` | Read the businesses the account can reach, so agents pick the right one | | `customer:*` | Read and update customers when an invoice needs one | | `invoice:*` | Read, draft and send invoices | | `product:*` | Read and update the products and services invoices are built from | | `account:read` | Read the chart of accounts, needed to categorise transactions | | `transaction:*` | Record money transactions such as payments and expenses | ## Review or verification Wave must approve the app before businesses other than the owner's own can connect, and each connected business needs an active Wave Pro or Wave Advisors plan. ## Runner validation On dev, **Connect Wave** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.