feat: support alternate connection methods and expand the app catalog

[guyb1]

Summary

A batch of shared changes: alternate connection methods, a custom-credentials entry point, two new app-catalog entries, removal of the dead is_platform secret column, and a client-side gateway cache helper.

Connections

• App definitions can declare additionalMethods alongside the primary connectionMethod. The credentials-connect route resolves the requested method (e.g. an API-key option offered next to OAuth) and rejects an explicit but unrecognized method instead of silently falling back.
• resolveMetadata validation failures now surface to the user as a 400 with the underlying message instead of a generic error.
• New optional helpUrl/helpLabel hints for connection fields, plus a custom-credentials entry point in the connect flow.

App catalog

• Add Attio and X (Twitter) catalog entries with light/dark icons.
• Pass ATTIO_CLIENT_ID/ATTIO_CLIENT_SECRET through the turbo env allowlist.

Secrets

• Drop the unused is_platform column end to end: Prisma schema + migration, the gateway SecretRow and its SELECTs, and the platform-secret special-casing in the secret service.
• Reorder the secret dialog fields and clarify the value label.

Gateway cache

• Replace the server-action cache flush with a client-side invalidateGatewayCache() helper that calls the gateway directly and authenticates as the acting user; data hooks invoke it on mutation.

Misc

• Remove dead edition branches from the docker entrypoint.

Testing

• pnpm check (lint + types + format across the workspace, incl. cargo clippy -- -D warnings) — green
• cargo fmt --check + cargo clippy --all-targets for the gateway — green
• pnpm db:generate — schema valid; migration is a single DROP COLUMN