[setup] Register Jaah with Canva's MCP server

**User-only setup task.** Only a person can do the steps below (Canva must approve Jaah as an MCP client). Runner: do NOT attempt the vendor-side steps and do not open a PR. Ask the operator once through AskUserQuestion (header `Human act`) to do the steps; when they say it is done, run **Runner validation** on dev and settle `no_pr` / `no_code_needed`, citing the observed result (never a secret value). If validation fails, name the step that looks wrong and ask once more. A person must do this: Canva's MCP server admits only clients Canva has approved, and asking for that needs a human at Canva. Once done, members connect Canva with one **Connect Canva** button. ## Steps 1. Sign in to Canva with the account that should own Jaah's access (a shared company account, never a personal one), and open: https://www.canva.com/developers/ 2. Ask Canva to approve Jaah as a client of the Canva AI Connector (mcp.canva.com): in the Canva Developer Portal open your integrations, or contact Canva's developer support, and request MCP client access for an app named Jaah. 3. When Canva approves it, set the app's name to Jaah and its description to: Jaah agents read and create Canva designs for your team. 4. Give Canva both redirect URIs exactly as written: `https://app.dev.jaah.ai/api/credentials/connect/callback` (dev) and `https://app.jaah.ai/api/credentials/connect/callback` (prod), and both console origins: `https://app.dev.jaah.ai` and `https://app.jaah.ai`. 5. Copy the client ID Canva issues (and its client secret, if it issues one). Keep them in your password manager only until the next step is done. 6. In the Jaah console of each environment (dev first, then prod), signed in as an operator, open **Secrets**, select **New**, and create an **OAuth app** (`oauth_app`) secret owned by **System**, named exactly `MCP client · https://mcp.canva.com`, with Vendor `https://mcp.canva.com`, the client ID, the client secret if any, and Token endpoint auth `none` (or `client_secret_post` when there is a secret). 7. Never paste a client ID or secret into this task, a comment, a chat or an email. Reply here only with what you did. ## Runner validation On dev, create a Canva secret: **Connect Canva** ends on **Connected** and **Test** lists the server's tools. Read only the result, never the secret. ## Out of scope No code change. Do not edit the vendor spec, the catalog engine or any other credential. Never paste a client ID or secret anywhere. ## Done means - The operator confirmed the steps are done. - On dev, Connect Canva ends on **Connected** and **Test** lists the Canva MCP server's tools — cited from what you observed.