P4 core: broker-held app connections + gated, broker-executed Slack posting

- app_connections repo; POST /api/apps/connect (keys/basic): the credential
  goes to the secret broker over its socket and only the encrypted ref lands
  in the row; disconnect endpoint; /api/apps directory merged with live
  connection status; audit rows for connect/disconnect
- Broker protocol: InvokeHttp carries a JSON body
- slack.post tool (SendsExternally -> gated): marked broker_executed — the
  runtime skips its own grant consumption and the BROKER independently
  verifies + consumes the single-use grant, then calls Slack with the bot
  token injected; the runtime never sees the credential
- Config: [broker] socket_path + [slack] base_url; e2e harness spawns the
  real teamclaw-broker daemon and the server hosts an e2e-only /__slack sink
- SlackApp: Connection tab stores the token via the broker; connected state
- Integration test: blocked while pending -> approved -> sink received
  exactly one post with 'Bearer xoxb-test-token' -> grant replay refused
- E2E journey: connect Slack in the panel -> gated post card with preview ->
  sink empty while pending -> approve -> exactly one post, queue clear

133 Rust + 63 frontend tests + 21 Playwright journeys.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-secrets/tests/broker.rs

@@ -205,7 +205,12 @@ async fn capability_requires_an_unconsumed_grant() {
     .await
     .unwrap();
     let refused = client
-        .invoke_http(pending.id, secret_id, &format!("{receiver_url}/hook"))
+        .invoke_http(
+            pending.id,
+            secret_id,
+            &format!("{receiver_url}/hook"),
+            json!({}),
+        )
         .await;
     assert!(matches!(refused, Err(BrokerError::GrantRefused)));
     assert!(seen.lock().await.is_empty(), "nothing may execute");
@@ -214,7 +219,12 @@ async fn capability_requires_an_unconsumed_grant() {
     // credential itself never crosses back over the socket.
     let approval_id = approved_approval(&pool, &seed).await;
     let status = client
-        .invoke_http(approval_id, secret_id, &format!("{receiver_url}/hook"))
+        .invoke_http(
+            approval_id,
+            secret_id,
+            &format!("{receiver_url}/hook"),
+            json!({}),
+        )
         .await
         .unwrap();
     assert_eq!(status, 200);
@@ -224,7 +234,12 @@ async fn capability_requires_an_unconsumed_grant() {
 
     // The grant is single-use: replay refused, no second call.
     let replay = client
-        .invoke_http(approval_id, secret_id, &format!("{receiver_url}/hook"))
+        .invoke_http(
+            approval_id,
+            secret_id,
+            &format!("{receiver_url}/hook"),
+            json!({}),
+        )
         .await;
     assert!(matches!(replay, Err(BrokerError::GrantRefused)));
     assert_eq!(seen.lock().await.len(), 1);
@@ -244,7 +259,7 @@ async fn non_http_urls_are_rejected() {
         .unwrap();
     let approval_id = approved_approval(&pool, &seed).await;
     let refused = client
-        .invoke_http(approval_id, secret_id, "file:///etc/passwd")
+        .invoke_http(approval_id, secret_id, "file:///etc/passwd", json!({}))
         .await;
     assert!(matches!(refused, Err(BrokerError::Invalid(_))));
 }