feat(mcp): OAuth per-user connectors (§15) — providers, PKCE copy-paste flow, env credential delivery

- oauth_providers registry table (per-provider client creds) + db/oauth_providers.rs
- mcp/oauth.rs: authorization-code + PKCE S256, RAM-only TTL'd flow store, copy-paste consent
- mcp/install.rs + verify.rs: connector file install + manifest verification
- activate persists a pending row (needs_oauth); /mcp/oauth/start + /complete exchange code for refresh token
- credential delivery via env var on docker exec (google_authorized_user JSON), never on disk
- mcp_catalog/mcp_user_servers: additive OAuth columns (ensure_column), catalog_name/oauth_provider/deliver_json bare TEXT snapshots
- frontend: connector-detail.js (OAuth login panel), shared/connector-common.js, connectors.js admin Sign-in providers modal
- API: /mcp/providers (admin OAuth creds), /mcp/oauth/start|complete
- .gitignore: add /homes/ (instance data), /connectors/, /reset.sh; drop stale /secrets/

.gitignore

@@ -2,14 +2,13 @@
 # Copy of default.config.yaml with real API keys — never commit
 /config.yml
 /config/
-# OAuth tokens, credentials, WhatsApp session data
-/secrets/
-!/secrets/.gitkeep
 config.yml.bak
 blueprint/
 /.understand-anything
 # ── Database & runtime data ───────────────────────────────────────────────────
 /database/
+# Per-user container home dirs ({WD}/homes/{userid}) — instance data, not source
+/homes/
 # SQLite WAL-mode sidecar files (journal_mode=WAL)
 *.db-wal
 *.db-shm
@@ -18,6 +17,9 @@ blueprint/
 /logs/
 /tmp/
 /scripts/
+# Connector folders installed from the marketplace — instance data, like homes/
+# and database/, not source. See crates/skald-core/src/mcp/install.rs
+/connectors/
 
 # ── Rust build artifacts ──────────────────────────────────────────────────────
 /target/
@@ -58,6 +60,7 @@ scripts/.gitignore
 *.swo
 run-log.sh
 /backup.sh
+/reset.sh
 debug/
 
 # Honcho Docker secrets