P4 core: broker-held app connections + gated, broker-executed Slack posting

- app_connections repo; POST /api/apps/connect (keys/basic): the credential
  goes to the secret broker over its socket and only the encrypted ref lands
  in the row; disconnect endpoint; /api/apps directory merged with live
  connection status; audit rows for connect/disconnect
- Broker protocol: InvokeHttp carries a JSON body
- slack.post tool (SendsExternally -> gated): marked broker_executed — the
  runtime skips its own grant consumption and the BROKER independently
  verifies + consumes the single-use grant, then calls Slack with the bot
  token injected; the runtime never sees the credential
- Config: [broker] socket_path + [slack] base_url; e2e harness spawns the
  real teamclaw-broker daemon and the server hosts an e2e-only /__slack sink
- SlackApp: Connection tab stores the token via the broker; connected state
- Integration test: blocked while pending -> approved -> sink received
  exactly one post with 'Bearer xoxb-test-token' -> grant replay refused
- E2E journey: connect Slack in the panel -> gated post card with preview ->
  sink empty while pending -> approve -> exactly one post, queue clear

133 Rust + 63 frontend tests + 21 Playwright journeys.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-runtime/src/tools/mod.rs

@@ -8,6 +8,7 @@ mod clock;
 mod email;
 mod files;
 mod routine;
+mod slack;
 
 use std::collections::HashMap;
 use std::sync::Arc;
@@ -24,6 +25,7 @@ pub use clock::ClockNow;
 pub use email::EmailSend;
 pub use files::{FilesDelete, FilesList, FilesWrite};
 pub use routine::RoutineSchedule;
+pub use slack::SlackPost;
 
 /// Execution context handed to tools: who is acting, for which tenant.
 #[derive(Clone)]
@@ -32,6 +34,11 @@ pub struct ToolContext {
     pub workspace_id: WorkspaceId,
     pub agent_id: AgentId,
     pub blob: Arc<dyn BlobStore>,
+    /// Set only while executing an APPROVED gated call; broker-executed
+    /// tools hand it to the broker, which consumes the grant itself.
+    pub approval_id: Option<uuid::Uuid>,
+    pub broker_socket: Option<std::path::PathBuf>,
+    pub slack_base_url: String,
 }
 
 #[async_trait::async_trait]
@@ -48,6 +55,11 @@ pub trait Tool: Send + Sync {
     fn preview(&self, input: &Value) -> Value {
         input.clone()
     }
+    /// Whether the broker executes this tool (and consumes the execution
+    /// grant itself). Default: the runtime consumes the grant.
+    fn broker_executed(&self) -> bool {
+        false
+    }
     async fn execute(&self, ctx: &ToolContext, input: Value) -> Result<Value, String>;
 }
 
@@ -68,6 +80,7 @@ impl Default for ToolRegistry {
         registry.register(Arc::new(RoutineSchedule));
         registry.register(Arc::new(ChatSend));
         registry.register(Arc::new(ChatInbox));
+        registry.register(Arc::new(SlackPost));
         registry
     }
 }
@@ -94,6 +107,11 @@ impl ToolRegistry {
         self.tools.get(name).and_then(|t| t.output_taint())
     }
 
+    /// Whether the named tool is broker-executed.
+    pub fn broker_executed(&self, name: &str) -> bool {
+        self.tools.get(name).is_some_and(|t| t.broker_executed())
+    }
+
     /// The approval-card preview for a tool input.
     pub fn preview_of(&self, name: &str, input: &Value) -> Value {
         self.tools