fix: slack channel diagnostics, GW default persistence, model registry

[meidad]

Summary

Grab-bag of fixes for issues that surfaced after #56 merged. Three themes:

Slack channels and diagnostics

• /api/slack/channels was returning 500 because it read secrets raw from SQL — but the integrations table encrypts at rest. Added decryptSecret() step. (settings/src/app/api/slack/channels/route.ts)
• account_inactive diagnostic upgraded to actionable in both slack-user.ts and slack-polling.ts — exact fix steps (reinstall at api.slack.com/apps + Reconnect) instead of a generic WARN. The onAuthError callback grew an {kind, reason} info argument so the gateway can broadcast a structured `auth_error` event to the UI.
• Default-channel reachability probe at boot — runs conversations.info on both bot AND user tokens, surfaces distinct diagnostics for wrong workspace token / stale default vs bot not in channel.
• sendAsAgent retries with user client when the bot post fails with `channel_not_found` (the common "forgot to /invite @nomos to this channel" case). Agent stops going dark.
• User-token workspace mismatch detector — validates auth.team_id matches the workspace's expected teamId at boot. Catches OAuth callbacks that wrote the wrong token to a per-workspace row.

Google Workspace "Make default" wasn't persisting

The integrations table's `metadata` column was being double-encoded via `JSON.stringify({...})::jsonb` — postgres.js wraps an already-stringified JSON object again, producing JSONB STRINGS like `"{\"is_default\":true}"` instead of JSONB OBJECTS. Every `metadata->>'is_default'` lookup returned NULL, so the PATCH's `jsonb_set` was a no-op.

Fixes:

• All writers use `sql.json({...})` (settings/src/lib/sync-google-accounts.ts, settings/src/app/api/google/accounts/route.ts)
• PATCH overwrites metadata wholesale instead of jsonb_set — wholesale replace self-heals legacy bad rows on the next click
• `/api/google/status` reads the manifest first (source of truth) so it agrees with `/api/google/accounts` and the make-default change shows up immediately

Model registry made dynamic + corrected to Anthropic docs

• New src/sdk/model-capabilities.ts and settings/src/lib/model-capabilities.ts with the full lineup: Opus 4.7/4.6/4.5, Sonnet 4.6/4.5, Haiku 4.5. Per-model `contextWindow`, `maxOutputTokens`, family.
• Corrected per docs.claude.com/en/docs/about-claude/models/overview:
  • 1M context (no beta): Opus 4.7, Opus 4.6, Sonnet 4.6
  • 200K context: Opus 4.5, Sonnet 4.5, Haiku 4.5
  • Max output: Opus 4.7/4.6 → 128K (was 32K), Haiku 4.5 → 64K (was 8K)
• /admin/context Model Limits panel renders from the registry with the current model highlighted; reports the actual context window from the running config.
• Settings page model picker and `/model` slash-command derive from the registry too — add a new model in one place, it shows up everywhere.

Bonus: `NOMOS_BETAS` is now mapped to the `app.betas` config row so future betas can be exposed via UI without another schema change.

Test plan

• Settings → Slack → reconnect a workspace, verify the channel picker loads (was 500ing).
• In Settings → Google, with two accounts, click "Make default" on the non-default one. Verify the badge flips AND survives a page reload.
• /admin/context: confirm the context window reported at top matches the model in use (1M for Opus 4.7, etc.). The per-model card grid highlights the current model.
• In CLI, run `/model` — see Opus 4.7 in the picker with the "1M context" note.
• If your Slack bot is in a workspace where it's not invited to the default channel, restart the daemon and try sending a message. Agent should reply (falling back to user-mode); look for the warn line about `/invite @`.
• If the Slack bot account is genuinely inactive in a workspace, restart the daemon and see the actionable ERROR + `auth_error` event.

🤖 Generated with Claude Code