feat(crm): enrich_contact tool — auto-fill email/phone via Dropcontact

[BluegReeno]

Context

Contacts created from LinkedIn searches often lack email and phone. The partial unique index on `(workspace_slug, email) WHERE email IS NOT NULL` (B4, #22) now supports dedup by email — but only when email is known at ingestion time.

An enrichment tool would let the agent fill in missing contact data on demand.

Proposed tool: `enrich_contact`

Input
```json
{
"workspace_slug": "blue-green",
"contact_id": "",
"provider": "dropcontact" // default, only supported provider v1
}
```

Behaviour

1. Fetch contact from `halcrm_contacts` (name + company domain from linked `halcrm_companies`)
2. Call Dropcontact API with `first_name`, `last_name`, `company` (+ optional `website`)
3. On match: upsert `email` + `phone` back into `halcrm_contacts`
4. Return enriched fields + confidence score

Why Dropcontact

• RGPD-compliant (data sourced from public B2B registries, not scraped personal data)
• French B2B coverage is strong (target market: BET, architects, promoteurs)
• Pay-per-enrichment (no monthly seat fee) — fits POC budget

Out of scope v1

• Batch enrichment (run on all contacts with email IS NULL)
• PhantomBuster / Hunter.io / Clearbit — Dropcontact is sufficient for BtoB FR
• Webhook / async enrichment — synchronous call is fine for POC

Implementation notes

• Dropcontact API key stored as Supabase secret (DROPCONTACT_API_KEY)
• Tool lives in supabase/functions/hal-mcp/index.ts alongside other CRM tools
• Enrichment is idempotent: call returns immediately if email is already set (unless force=true)
• Depends on: halcrm_contacts email partial unique index (done, feat(halcrm): NOT NULL on halcrm_contacts.email + UNIQUE (workspace_slug, email) #22)

Priority

Backlog — useful before first real client onboarding. Not blocking Loop 1.