feat(integrations): provider-agnostic layer — Composio + Merge behind one trait

[ja-818]

What this does

Houston was hard-wired to Composio. After the May 2026 Composio incident (server-wide 403 on composio login), this adds a provider-agnostic integrations layer so Composio and Merge run interchangeably, picked per-user at runtime. No agent or UI code knows which provider is active.

Architecture

• engine/houston-integrations — the IntegrationsProvider trait + shared types + ProviderError taxonomy.
• engine/houston-merge — full Merge Agent Handler provider: OAuth 2.0 + PKCE + dynamic client registration, OS-keychain token storage, MCP client, connector catalog. No bundled CLI — pure Rust HTTP from the engine.
• engine/houston-composio — now implements the trait over its existing CLI internals (still bundled per-arch; legacy free-function API untouched).
• /v1/integrations/* — provider-agnostic REST surface. Legacy /v1/composio/* retained.
• Active provider persisted in preferences (integrations.active_provider, default Composio).
• System prompt follows the active provider — per-provider guidance moved into each provider crate, appended at session-spawn via compose_app_system_prompt.
• Frontend — provider picker (badge + dialog), provider-agnostic sign-in hook + dialog, Merge signed-in panel. EN/ES/PT.

Full write-up: knowledge-base/integrations-providers.md.

Verification

• 690 Rust unit tests + 3 integration tests pass
• cargo build --workspace clean (macOS)
• cargo check --target x86_64-pc-windows-gnu -p houston-engine-server clean
• pnpm tsc --noEmit + pnpm check-locales clean

How to resume on a new machine

git fetch && git checkout gcp-remote-claude-sessions && git pull
cargo build -p houston-engine-server   # MUST rebuild engine before dev (stale-sidecar rule)
cd app && pnpm install && pnpm tauri dev

Where we left off (next actions)

• Just fixed: 422 on Merge sign-in (camelCase request bodies). Committed but needs the engine rebuild above to test live.
• Next: rebuild engine, restart dev, click Sign in on the Merge panel, confirm OAuth completes end-to-end.
• Unverified: Merge list_connections — the introspection tool name is a best-guess until tested against a real Merge account.

🤖 Generated with Claude Code