[Feat] Let operators disable curated integrations

[roomote-community]

Created by Roomote. Follow up by mentioning @roomote, in the web UI, or in Discord.

What changed

• Added the operator-level R_CURATED_INTEGRATIONS_DISABLED policy. Curated integrations stay enabled for all deployments by default; setting the flag to true switches the catalog off. Available in both Compose deployment paths.
• While disabled, rejects curated integration setup, OAuth initiation and callbacks, tool management, and direct MCP access.
• Makes retained connections unavailable to task runtimes, Linear webhooks, routing, and active Linear sessions without deleting credentials or database records.
• Replaces integration controls with a deployment-operator notice and documents the policy and its scope.
• Updates the Linear OAuth test environment mock so the full CI suite exercises the policy-aware setup path correctly.

Why this change was made

Some deployments need to prohibit curated integrations from being configured accidentally. The policy is opt-out so existing deployments keep working unchanged on upgrade. This control belongs to the instance operator rather than an in-product admin cleanup action, so administrators cannot override it from the UI.

Impact

Nothing changes by default. Operators can set R_CURATED_INTEGRATIONS_DISABLED=true and restart Roomote to prevent every integration in Settings > Integrations from being configured or used. Existing connection records remain intact and become available again once the value is unset. Communications, source-control, inference, and sandbox providers, plus environment-defined MCP servers, are intentionally unaffected.

[roomote-community]

1 issue outstanding. See task

• apps/api/src/handlers/mcp/routing.ts:19 The new policy only guards /api/mcp/*; /api/mcp-routing/linear still creates the Linear proxy unconditionally, so a router with an auth token can continue using the stored Linear connection after R_CURATED_INTEGRATIONS_DISABLED=true.
• packages/sdk/src/server/routers/linear-sessions.ts:27 Existing Linear-triggered tasks can still emit thoughts, responses, and elicitation after the flag is disabled because the Linear session client resolves the stored connection without the policy check. Gate this path so disabling takes effect for in-flight runs too.
• packages/sdk/src/server/routers/linear-sessions.ts:182 Queued Linear messages can still create a SnapshotResume task after the operator disables integrations: this router path and the BullMQ snapshot path both call the ungated drain helper. Check the policy before draining, or make the helper policy-aware, so messages received before the flag change cannot start a new run afterward.

_{Reviewed 40e56e6}

[roomote-community]

Reworked this as an operator-level preventative policy and pushed the final enforcement fixes in 0a0c91b.

• R_CURATED_INTEGRATIONS_ENABLED=false prevents curated integration setup and use without deleting stored connections.
• Configuration, OAuth callbacks, task runtime materialization, direct MCP routes, Linear webhooks, routing, and active Linear session output are gated.
• Settings now explains that integrations are disabled by the deployment operator.
• Focused tests, package type checks, docs validation, and the full pre-push gates pass.

CI follow-up: 811d461 updates the Linear OAuth env mock with the newly required policy helper. The replacement GitHub CI run 30836579320 passed, including the full unit test job, lint, type checking, knip, deployment validation, upgrade compatibility, backup restore, and both Docker builds.