feat: tighten integration administration APIs

[shakkernerd]

Summary

• require workspace managers for integration mutations while preserving connected-account self-revocation
• add signing-secret rotation for slash commands and event subscriptions
• add stable cursor pagination for event delivery attempts
• atomically cascade app uninstall revocations with configurable bot-token handling
• expose and validate the durable event-type vocabulary
• update OpenAPI, TypeScript SDK, documentation, and changelog

Verification

• full pnpm check
• SQLite and PostgreSQL integration lifecycle tests
• authorization, secret rotation, HMAC, cascade rollback, and pagination regression coverage
• sqlc and OpenAPI regeneration checks
• independent Codex review with all accepted findings fixed

Remote validation: AWS Crabbox cbx_62daafbedec3

[shakkernerd]

Merged using rebase.

What changed after review:

• Added bot-token coverage for both signing-secret rotation endpoints, restoring the Go coverage gate to 85.1%.
• Strengthened the tests to assert the handler-specific bot-token rejection instead of accepting any 403.
• Preserved the reviewed integration contracts, generated artifacts, SDK surface, and documentation.

Verification:

• Rebased/refreshed onto current origin/main before pushing.
• AWS Crabbox cbx_5db52fe83def: focused HTTP route tests and the exact Go coverage gate passed.
• Bot-token rotation requests were verified to fail at the human-session boundary with the expected errors.
• Auto-review: clean after the accepted test-strength finding was resolved.
• GitHub checks: all checks green.

Landed on main:

• Final landed SHA: e84d90f; range 7012841...e84d90f.

Thanks @shakkernerd!