feat(mcp): OAuth per-user connectors (§15) — providers, PKCE copy-paste flow, env credential delivery

- oauth_providers registry table (per-provider client creds) + db/oauth_providers.rs
- mcp/oauth.rs: authorization-code + PKCE S256, RAM-only TTL'd flow store, copy-paste consent
- mcp/install.rs + verify.rs: connector file install + manifest verification
- activate persists a pending row (needs_oauth); /mcp/oauth/start + /complete exchange code for refresh token
- credential delivery via env var on docker exec (google_authorized_user JSON), never on disk
- mcp_catalog/mcp_user_servers: additive OAuth columns (ensure_column), catalog_name/oauth_provider/deliver_json bare TEXT snapshots
- frontend: connector-detail.js (OAuth login panel), shared/connector-common.js, connectors.js admin Sign-in providers modal
- API: /mcp/providers (admin OAuth creds), /mcp/oauth/start|complete
- .gitignore: add /homes/ (instance data), /connectors/, /reset.sh; drop stale /secrets/

crates/skald-core/src/tools/fs/mod.rs

@@ -110,7 +110,7 @@ pub fn resolve(user_path: &str) -> Result<PathBuf> {
 /// does not exist yet) is appended lexically. Falls back to a pure lexical normalization
 /// when nothing along the path can be canonicalized.
 ///
-/// This closes `docs/../secrets/x` traversal and symlink escapes for both the allow
+/// This closes `docs/../private/x` traversal and symlink escapes for both the allow
 /// fast-paths (`RunContext`) and the deny rules (`approval::normalize_path`).
 pub fn canonicalize_for_policy(path: &str, base: &Path) -> PathBuf {
     let raw = {