feat(mcp): OAuth per-user connectors (§15) — providers, PKCE copy-paste flow, env credential delivery

- oauth_providers registry table (per-provider client creds) + db/oauth_providers.rs
- mcp/oauth.rs: authorization-code + PKCE S256, RAM-only TTL'd flow store, copy-paste consent
- mcp/install.rs + verify.rs: connector file install + manifest verification
- activate persists a pending row (needs_oauth); /mcp/oauth/start + /complete exchange code for refresh token
- credential delivery via env var on docker exec (google_authorized_user JSON), never on disk
- mcp_catalog/mcp_user_servers: additive OAuth columns (ensure_column), catalog_name/oauth_provider/deliver_json bare TEXT snapshots
- frontend: connector-detail.js (OAuth login panel), shared/connector-common.js, connectors.js admin Sign-in providers modal
- API: /mcp/providers (admin OAuth creds), /mcp/oauth/start|complete
- .gitignore: add /homes/ (instance data), /connectors/, /reset.sh; drop stale /secrets/

crates/skald-core/src/skald/user_context.rs

@@ -200,14 +200,18 @@ impl UserContextFactory {
         {
             let um        = Arc::clone(&user_mcp);
             let upool     = Arc::clone(&pool);
+            let registry  = Arc::clone(&self.registry_pool);
             let container = crate::container::container_name(user_id);
             let mname: &'static str = Box::leak(format!("mcp:{user_id}").into_boxed_str());
             self.supervisor.adopt_one(mname, tokio::spawn(async move {
                 match crate::db::mcp_user_servers::all_startable(&upool).await {
                     Ok(rows) => {
-                        let specs = rows.iter()
-                            .map(|r| crate::mcp::user_row_spec(r, &container))
-                            .collect();
+                        let mut specs = Vec::with_capacity(rows.len());
+                        for r in &rows {
+                            // OAuth connectors resolve their stored refresh token into
+                            // the env-delivered credential here (§15).
+                            specs.push(crate::mcp::user_row_spec_resolved(r, &container, &registry).await);
+                        }
                         um.connect_all(specs, false).await;
                     }
                     Err(e) => tracing::warn!(error = %e, "per-user MCP init: failed to read mcp_user_servers"),