feat: OAuth Connected Accounts — provider-agnostic integration layer

[matthiastjong]

Summary

• Adds a Connected Accounts feature that lets users connect a Microsoft 365 account via OAuth and automatically provisions managed API targets for mail and calendar (Graph API)
• Provider config is a static code registry — OAuth credentials come from env vars, never stored in the database
• Managed targets are read-only (only permissions can be changed) and cascade-delete when disconnected
• Gateway auto-resolves OAuth tokens from the connected account for managed targets, with silent refresh and disconnected status tracking
• New Integrations dashboard page with connect/disconnect flow, manage access dialog with switch toggles
• Target detail page shows "Managed by" badge and hides edit controls for managed targets
• Bootstrap response includes integration context (email + capability) for agents

Architecture

connected_accounts (provider_type, email, OAuth tokens, status)
    └── targets (connected_account_id FK, capability: mail|calendar)
            └── token_permissions (existing, unchanged)

Provider registry: src/lib/server/providers.ts (static, env vars for credentials)
Connected accounts service: src/lib/server/services/connected-accounts.ts
OAuth routes: src/routes/oauth/authorize/ + src/routes/oauth/callback/

Key design decisions

1. No integration_providers DB table — providers defined in code, credentials from OAUTH_MICROSOFT_CLIENT_ID / OAUTH_MICROSOFT_CLIENT_SECRET env vars
2. Two managed API targets per account (mail + calendar) — agents use api_request against Graph API, no dedicated calendar tools
3. Managed targets throw on mutation — updateTarget/deleteTarget throw Error for managed targets
4. Unique constraint on (provider_type, email) — prevents duplicate accounts
5. In-memory mutex deduplicates concurrent token refresh calls
6. Slug suffix (account ID prefix) prevents collision on reconnect

Test plan

• 296 automated tests passing (11 new: connected-accounts, gateway-managed)
• Manual E2E: Connect Microsoft 365 → consent → managed targets created → mail + calendar via Graph API verified
• Shared mailbox access verified (Mail.ReadWrite.Shared scope)
• Disconnect → managed targets cascade deleted
• Managed target edit/delete blocked in UI and API
• Token refresh with status tracking tested

🤖 Generated with Claude Code