Add Pipedream Connect integrations

[Tallen231210]

Draft implementation for the idea in #545. Keeping this draft until the proposal is aligned with maintainers.

What changed

• adds Pipedream Connect as a managed, customer-facing integrations catalog
• gives the web UI a dedicated Integrations destination for searching Pipedream's app catalog, starting app-specific OAuth, choosing read-only or read/write access, and explicitly sharing an account with a workspace
• exposes one lazy integrations agent tool for account discovery, tool discovery, and calls instead of injecting thousands of schemas
• keeps third-party credentials inside Pipedream; QM stores durable account metadata and policy only
• wires Pipedream operator credentials into runtime and CLI deployment secret schemas

Safety model

• connected accounts start personal and read-only
• workspace sharing is explicit and membership checked
• every external operation requires human approval; approvals are HMAC-bound to the exact account, tool, and canonical arguments
• provider read-only hints are not trusted for authorization
• portal identity is bound to every management route, which remains source-only rather than agent-callable
• remote requests have deadlines and bounded response bodies and result counts
• Connect capability URLs are restricted to Pipedream's documented HTTPS origin and path
• success, refusal, and failure audits identify the account, scope, tool, and policy delta without recording arguments or credentials
• provider sync atomically preserves current local access and scope policy across concurrent instances

Demo

Rendered in a live dev instance using Pipedream's real app catalog. Search, app-specific Connect link creation, cancellation, duplicate-click protection, keyboard focus, narrow layouts, and late-response navigation safety were exercised in Firefox; actionable browser console output was clean.

Validation

• root, CLI, and web TypeScript checks
• ESLint and Oxlint
• Prettier and git diff --check
• affected backend/security suite: 117 tests passed; app-picker and portal-identity regression suite: 42 tests passed
• complete web UI suite: 554 tests passed
• production web build
• live Firefox QA of desktop and narrow integrations flows against the real Pipedream catalog
• fresh independent security and lifecycle reviews: clean