WS8 PR E: connectors gallery

Curated MCP connector gallery: a Popular row, All/Connected/Not-connected
filters, a status column ("Connection issue"), initial-letter tiles (no real
brand-logo assets), and one-click Connect for honesty-verified providers, plus
a firm-admin curation card over the org enabled_connector_ids shortlist.

Honesty rule: a provider is only one-click when a public remote MCP server with
OAuth was verified to exist (July 2026) - Google Drive/Gmail/Google Calendar,
Canva, Apollo.io. Everything else (Microsoft 365, DocuSign, Slack, Teams,
HubSpot, Clio) is an informational "custom" entry with no dead Connect button.
Per-provider verification sources recorded in mcpConnectorRegistry.ts and the
BUILD_LOG.

Backend: mcpConnectorRegistry.ts + mcpConnectorGallery.ts (pure status
derivation + org-curation filtering); org enabled_connector_ids read/write;
GET/POST /user/connector-gallery (connect is requireMemberPolicy+MFA gated,
SSRF guard preserved via validateRemoteMcpUrl); GET/PATCH
/admin/connector-gallery (requireAdmin+MFA, registry-id validated).

Frontend: rebuilt account/connectors gallery per the approved mock-up (existing
custom-connector form kept as "Add custom connector"; PR #38 neutral card
preserved when policy off); firm-settings Connectors curation card; mikeApi
methods.

Tests: 43 new (registry/honesty invariants, gallery status derivation, org
filtering incl. empty=all, connect policy-gating + 404 validation, admin
curation authz+validation). Backend 252 vitest pass; frontend tsc + lint at
baseline; evals:smoke 4/4 from main.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>