Clio connector PR 2: backend (lib/clio seam, routes, chat tools)

Self-contained lib/clio/ seam plus /clio + /clio-grow routes, chat-tool
wiring, and profile serialization for the Clio Manage + Grow connectors.
No migration/.env/schema.sql/LICENSE touched.

- config: region host maps (EU live), creds, redirect-URI derivation,
  pinned Manage X-API-VERSION (4.0.11, env-overridable).
- connections: user_clio_connections CRUD over shared apiKeyCrypto;
  42P01/42703-tolerant; atomic refresh-rotation persistence.
- oauth: start/callback both products; one-time in-process state; PKCE
  S256 for Grow; who_am_i on connect; best-effort deauthorize.
- client: per-user authed fetch; proactive + 401 single refresh/retry;
  Grow rotating refresh persisted before use; 429 Retry-After + rate
  buckets (Manage 50/min, Grow 3/s app-wide); fixed error mapping.
- manage/grow chat tools registered through the companiesHouse seam,
  gated on the product being connected; writes confirmed via prompt;
  save-document enforces ensureDocAccess + 25 MB cap via presigned upload.
- routes: oauth start/callback (callback = exact registered path),
  /status (both products + cheap Manage count), MFA-gated disconnect.
- chat + projectChat gate Clio tools on listConnectedProducts; profile
  exposes clioConnections {manage, grow}.

Verified: tsc clean; vitest 584/584 (513 baseline + 71 new); prettier
clean on new files. Built on the 03/08 spike/write-probe verified facts
(EU hosts, seconds semantics, 3-step upload, rotation, rate limits).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>