R4 backend: team org-chart + leaderboard, Stripe credits, workspace apps

- GET /api/team/orgchart — each member grouped with the claws they manage
  (agents.managed_by); GET /api/team/leaderboard — every claw ranked by
  its real usage_events rollup (credits/tokens/runs, zeros included).
  Both tested against real Postgres.
- Stripe Buy-credits (the Slack/Clerk integration pattern): [billing]
  config (stripe keys + price + webhook secret + credits_per_pack);
  POST /api/credits/checkout opens a real Checkout Session; POST
  /api/billing/stripe verifies Stripe's t=,v1= HMAC (constant-time) and
  grants one credit lot, idempotent on the session id; GET
  /api/billing/config gates the button (honest degradation when unset).
  Offline tests: signed grant + replay no-double-grant + forged-sig 400 +
  config flag. Live checkout creation deferred to a CM_LIVE_STRIPE test.
- /apps global page support: clawId now optional on connect + directory;
  absent => workspace-wide connection (app_connections.agent_id NULL) via
  new connections::list_for_workspace.
- ApiError gains a From<sqlx::Error> so inline queries use ? cleanly.

cm-api 10 test files incl. team_tabs (2) + stripe_billing (3); clippy clean.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/cm-db/src/repo/connections.rs

@@ -71,6 +71,24 @@ pub async fn list_for_agent(
     Ok(rows)
 }
 
+/// Workspace-wide connections (agent_id IS NULL) — the global /apps page.
+pub async fn list_for_workspace(
+    pool: &PgPool,
+    workspace_id: WorkspaceId,
+) -> Result<Vec<AppConnection>, DbError> {
+    let rows = sqlx::query_as!(
+        AppConnection,
+        r#"SELECT id, workspace_id, agent_id, provider, auth_type, status, secret_ref
+           FROM app_connections
+           WHERE workspace_id = $1 AND agent_id IS NULL AND status = 'connected'
+           ORDER BY created_at"#,
+        workspace_id.as_uuid(),
+    )
+    .fetch_all(pool)
+    .await?;
+    Ok(rows)
+}
+
 /// The agent's live connection for one provider, if any.
 pub async fn find_provider(
     pool: &PgPool,