Fix adapter bugs and add 13 new connectors

[keysersoft]

Summary

Two-part change: fix systemic bugs that were preventing every JSON adapter in the catalog from working, and add 13 new adapters covering public data, Baustoff/Wholesale, logistics, ERP, e-commerce, mapping, and HR.

REST engine fixes

• mapParams now recurses into nested objects/arrays — FastBill-style nested bodies (FILTER.TERM) now interpolate correctly instead of shipping literal $TERM.
• New QUERY_AUTH auth type: injects authConfig values as query parameters, for APIs that pass credentials in the URL (e.g. Destatis, Oxomi, HERE).
• ${param} interpolation now works embedded inside strings (e.g. "ExternalId eq '${externalId}'" for OData filters), not just as whole-string references.
• Endpoint queryParams merge with auth-injected params instead of overwriting them.

Existing adapters (16) — bug fixes

All 16 DE adapters were affected by at least one of:

• ${x} in path (engine expects {x}) — widespread
• ${x} in queryParams/bodyMapping/headers (engine expects $x) — widespread
• "authType": "BASIC" instead of "BASIC_AUTH" — FastBill, MFR
• "body" field instead of "bodyMapping"/"bodyTemplate" — FastBill, Scopevisio, MFR link endpoints
• Destatis credentials wired through queryParams with {{VAR}} templating that never ran — moved to QUERY_AUTH authConfig

All fixes applied via a migration script (.context/fix-adapters.mjs, gitignored).

Tests

• packages/backend/src/adapters/catalog.spec.ts (new): parametrized smoke test over every adapter — validates method, path placeholder format, authType whitelist, no legacy body field, and that every $ref/${ref} in queryParams/bodyMapping/headers points to a declared tool parameter (catches typos in future adapters).
• packages/backend/src/connectors/engines/rest.engine.spec.ts: added coverage for recursive bodyMapping, missing-param drop, QUERY_AUTH injection + queryParams merge, embedded ${x} interpolation, empty-result drop.

275/275 tests passing across rest.engine.spec + catalog.spec. TypeScript compiles clean. The 5 test failures in roles/users/tool-registry are pre-existing on main (verified by stashing changes) and unrelated to this PR.

New adapters (13)

All declare requiredEnvVars so the frontend import UI auto-generates the credential form with masked inputs for keys/tokens/passwords.

Public data

• vies-vat — EU VAT number validation (no auth)
• handelsregister — German commercial register via handelsregister.ai (API key)
• deutsche-bahn — DB timetable & journey planner via v6.db.transport.rest (no auth)
• openplz — German postal codes, localities, streets, districts (no auth)

Baustoff/Wholesale

• oxomi — Catalog, product, document search across Baustoff suppliers (portal id + user + access token)

Logistics

• dpd-germany — Public DPD parcel tracking (no auth)
• gls-tracking — Public GLS Track & Trace (no auth)
• shipcloud — Multi-carrier shipping aggregator for DE/EU (API key)
• sendcloud — Multi-carrier shipping for EU (public + secret key)

Other categories

• xentral — Xentral ERP (instance URL + user + password)
• shopware-6 — Shopware 6 Store API (instance URL + access key)
• here-geocoding — HERE geocoding & search (API key)
• personio — Personio HR (bearer token — Personio's rotating-token limitation documented in instructions)

Catalog is now 29 adapters total.

Test plan

• CI runs clean on the PR
• Manually import one no-auth adapter (e.g. vies-vat) in the UI — verify connector created and tools registered
• Manually import one credentialed adapter (e.g. handelsregister) — verify the UI prompts for HANDELSREGISTER_API_KEY and the secret is stored encrypted
• Run an end-to-end tool call against VIES VAT (public, no secrets) to confirm the engine fixes hold end-to-end