feat: add connections spec for third-party OAuth credentials

[stubbi]

Summary

• Adds a first-class connections field to the Instance CRD for configuring OAuth provider credentials
• Injects PAPERCLIP_OAUTH_CREDENTIALS from a referenced Secret into the Paperclip container
• Optionally injects PAPERCLIP_OAUTH_PROVIDERS from a ConfigMap for custom provider definitions
• Companion to paperclipinc/paperclip#15 which added the connections feature to Paperclip

Usage

spec:
  connections:
    credentialsSecretRef:
      name: paperclip-oauth-credentials

With a Secret containing:

apiVersion: v1
kind: Secret
metadata:
  name: paperclip-oauth-credentials
type: Opaque
stringData:
  PAPERCLIP_OAUTH_CREDENTIALS: |
    {
      "github": {"clientId": "...", "clientSecret": "..."},
      "slack": {"clientId": "...", "clientSecret": "..."}
    }

OAuth callback URL must be registered with each provider as:
https://<your-public-url>/api/connections/callback

Test plan

• 4 new unit tests (credentials injection, custom key, providers catalog, nil connections)
• All 22 existing tests pass
• Deploy with connections configured and verify OAuth flow works end-to-end

🤖 Generated with Claude Code