[setup] Register the Jaah Zoho Books OAuth

**User-only setup task.** Only a person can do the registration steps below (a human sign-in at the vendor). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed Connect + Test result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: registering an app at Zoho needs a human sign-in. It lets members connect Zoho Books to Jaah with one **Connect Zoho Books** button. ## Steps 1. Sign in to Zoho with the account that should own Jaah's app (a shared company account, never a personal one), and open the developer console: https://api-console.zoho.com/ 2. Create a new OAuth app. Name it **Jaah**. 3. Select GET STARTED (or ADD CLIENT if the account already has clients) and choose Server-based Applications, then CREATE NOW. 4. Under Client Name enter Jaah, and under Homepage URL enter the public homepage of the company that runs this Jaah (its https address). 5. Under Authorized Redirect URIs enter both, adding a row for the second with the + button: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod). 6. Select CREATE, then open the Client Secret tab and copy the Client ID and Client Secret. Keep them in your password manager only until the steps below are done. 7. Leave Multi-DC off for now: Jaah exchanges codes at accounts.zoho.com, so only US data-centre Zoho accounts can connect. 8. Scopes requested at sign-in: `ZohoBooks.settings.READ`, `ZohoBooks.contacts.ALL`, `ZohoBooks.invoices.ALL`, `ZohoBooks.bills.ALL`, `ZohoBooks.expenses.ALL`, `ZohoBooks.customerpayments.ALL`, `ZohoBooks.reports.READ`. 9. In the Jaah console of each environment (dev first, then prod), open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret on the operator plane named `jaah-zoho_books-app`, with provider `zoho_books`, the client ID and the client secret. 10. Open **Settings > Integrations > OAuth apps > Zoho Books** and pick that secret in the knob `oauth_app.zoho_books`. 11. Never paste the client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Scopes and why | Scope | Why Jaah asks for it | |---|---| | `ZohoBooks.settings.READ` | Read your organizations and settings, so Test can name the organization and agents can find its ID | | `ZohoBooks.contacts.ALL` | Read and update customers and vendors | | `ZohoBooks.invoices.ALL` | Read, draft and update invoices | | `ZohoBooks.bills.ALL` | Read and record vendor bills | | `ZohoBooks.expenses.ALL` | Read and record expenses | | `ZohoBooks.customerpayments.ALL` | Read and record customer payments against invoices | | `ZohoBooks.reports.READ` | Run reports such as profit and loss or aged receivables | ## Review or verification Not required: a server-based client works for any Zoho account in the US data centre once created. ## Runner validation On dev, **Connect Zoho Books** with the Jaah app ends on **Connected** and **Test** passes. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, the vendor's Connect screen no longer says "Jaah app not configured", consent ends on **Connected**, and **Test** passes — cited from what you observed.