Add read-only Atlassian and Read AI connectors

[cyber-moe99]

Summary

• add first-party read-only Atlassian and Read AI OAuth connectors
• expose both providers in the connector catalog, Keychain UI, portal labels, deployment secret schema, and setup guidance
• add reviewed seed skills for Jira/Confluence search and Read AI meeting reports, summaries, action items, and transcripts

Atlassian

• request Jira and Confluence read/search scopes plus offline_access
• exchange and refresh with Atlassian's JSON token contract
• validate accessible-resources and accept exactly one selected site, while deduplicating Jira and Confluence entries for the same Cloud ID

Read AI

• use OAuth 2.1 authorization-code flow with S256 PKCE and HTTP Basic client authentication
• request only openid profile email offline_access meeting:read
• persist every rotated refresh token and expose only api.read.ai to the agent
• document cursor/time-bound meeting listing, completed and live report reads, safe citation URLs, API limits, and permission-sensitive errors

Security boundary

• per-user OAuth; no service-token fallback
• no Jira, Confluence, or Read AI write scopes
• retrieved content is treated as untrusted; both seed skills document read-only API use and prohibit claiming writes
• connector secrets remain write-only deployment inputs and tokens stay in the encrypted credential store

Verification

• focused OAuth routes/adapters, connector catalog/filtering, secret-schema drift, and seed-skill suites: 100 passed
• root, CLI, web UI, and portal TypeScript checks passed
• synthetic standalone connector-card data used for screenshots; no deployment or user data appears

UI