Add one-click Connect for the partner-app vendors the waves

## Gap The plan named these vendors as partner OAuth apps (one-click **Connect <Vendor>** with a Jaah app), but their waves shipped them key/basic-auth only and filed no setup task: HubSpot (`hubspot.toml`, kind key), Zendesk (`zendesk.toml`, basic), Xero (`xero.toml`, key), Pledge (`pledge.toml`, key), Atlassian Jira/Confluence (`jira.toml` basic; `atlassian.toml` is MCP only), PostHog (`posthog.toml`, key), Workday (`workday.toml`, service_account). Members can still connect them by pasting keys, but not with the one-click flow the epic asked for ("Users need an easy way to connect"). Observed by the finish stage: `GET /api/integrations` on dev returns `oauth: null` for these slugs, while e.g. Airtable carries an `oauth` block. ## Fix (data files only, no new surface) For each vendor above, confirm from the vendor's OWN docs whether a public/multi-tenant OAuth app is offered. If yes: add `[auth.oauth]` (authorize/token URLs, scopes with reasons) and `[auth.oauth.registration]` with exact numbered steps to its spec under `apps/api/app/integrations/vendors/`, keeping the existing key method as the fallback (an existing `credential_type` changes no field), regenerate with `python3 tools/integration_docs.py --write`, add a mocked OAuth connect unit test, and upload `python3 tools/integration_docs.py --task-body <slug>` as `setup-<slug>.md` (`artifact_upload`, kind `file`). If no: add one `docs.limitations` line saying why there is no one-click Connect, with the vendor doc URL. Workday and Pledge are likely "no" (customer-tenant or partner-only); verify, don't assume. ## Acceptance - Every vendor above either has an OAuth method + registration block, or a limitations line citing the vendor doc. — reviewer reads each spec. - `tools/integration_docs.py --check` green; the catalog registry tests green. - Each new OAuth vendor's `--task-body` output uploaded and listed in the report, so a human setup task can be filed from it (name them in the settle summary). - `./dc check quick` green. ## Out of scope Any engine, route or React change; other vendors; registering the apps (a human task); runner auth; billing. Done means: - The above holds, with the PR merged and the uploaded `setup-<slug>.md` names listed in the report.

Vendor docs checked: no data-only one-click Connect is possible for the 7 vendors. Each spec now has a cited no-Connect limitation and a guard test. Quick gate green; PR #7931 queued. No setup-<slug>.md files (no OAuth added). Engine work filed as draft 13619.