feat(providers): add Slack example profile with rotating user tokens

[n1hility]

Summary

Adds a Slack example provider profile whose user token is kept fresh by the gateway's oauth2_refresh_token engine, and fixes the one thing that made Slack unusable with that engine: Slack's token endpoint reports failures with HTTP 200 and an error body, which the gateway treated as a malformed success and retried every minute forever instead of parking the grant for reauthorization.

Related Issue

Fixes #3729 (filed alongside this PR; in triage). If maintainers prefer, the first commit (fix(server)) stands on its own as a localized bug fix and can be split out.

Changes

• fix(server): when a 2xx token response does not parse as a token but does parse as an OAuth error response, route it through the existing error classifier instead of recording oauth_invalid_success_response. Slack's error names are folded onto the existing RFC failure codes with the issuer name preserved as provider_error_subtype, following the invalid_rapt / admin_policy_enforced precedent: invalid_refresh_token, token_revoked, token_expired, account_inactive, invalid_auth map to oauth_invalid_grant (parked for user grants, configuration repair for non-interactive grants); invalid_client_id, bad_client_secret to oauth_invalid_client; invalid_grant_type to oauth_unsupported_grant_type; ratelimited, accesslimited, request_timeout, service_unavailable, internal_error, fatal_error to oauth_token_endpoint_retryable. Of these, invalid_refresh_token, the client errors and the transient names are documented for oauth.v2.access; token_revoked, token_expired, account_inactive and invalid_auth are Slack's general authentication errors and are included defensively.
  • The issuer table is consulted only for errors that arrived in a 2xx envelope. This is deliberate: RFC 6749 error responses (4xx) classify byte-for-byte as before, so the change is confined to a path that today is already a permanent failure. None of the issuer names collide with RFC names, so the gate can be lifted later if an issuer is found to send these names on 4xx.
  • Successful token bodies are handled exactly as before; a 2xx body with neither a token nor an error still reports oauth_invalid_success_response; no provider-controlled text reaches the status message.
• feat(providers): providers/slack.yaml example profile (bearer SLACK_USER_TOKEN, oauth2_refresh_token against oauth.v2.access, 43200 s lifetime cap matching Slack's fixed token lifetime, 21600 s lead, client_id / client_secret / refresh_token material) with the standard example header, plus docs/how-it-works/providers/slack.mdx and a nav entry. Also tightens ProviderTypeProfile::adc_credential to require the Google token endpoint alongside the three ADC material keys, so --from-gcloud-adc does not accept the Slack profile just because its material has the same shape (happy to split this into its own commit if preferred).
• fix(providers) (follow-up after self-review): the example grants read-only access. Slack's read methods accept GET and the token travels in the injected header, so the read-only preset covers reads and keeps write methods denied until a policy allows them, matching the GitHub example. Docs offer the raw-URL import form used by the sibling pages.

Out of scope on purpose: openshell-core/src/oauth.rs (extension token-grant / RFC 8693 exchange) has the same status-only success check and is untouched.

Testing

Run on this branch (rebased on main at b52eed7):

• cargo test -p openshell-server --lib provider_refresh — 60 passed. New tests: issuer error names map by grant kind; client/transient errors keep RFC failure codes; issuer names on a 400 stay unrecognized (4xx behaviour unchanged); a 200 error body parks the state as reauthorization_required; a 200 body with neither token nor error still reports oauth_invalid_success_response; a Slack-shaped success body mints with a 12 h lifetime and persists the rotated refresh token.
• cargo test -p openshell-server --lib profile — 132 passed (example catalog list updated).
• cargo test -p openshell-providers — 135 passed (new slack_profile_declares_rotating_user_token; the example catalog validates with the new file).
• cargo test -p openshell-cli adc — the --from-gcloud-adc tests pass with the tightened detection.
• cargo fmt --all --check, cargo clippy --workspace --all-targets -- -D warnings, scripts/update_license_headers.py --check (1151 files), and markdownlint-cli2 (152 files, 0 issues) all clean. mise is not installed on the development machine, so these pre-commit sub-tasks were run directly.
• Verified against a live Slack app with token rotation enabled on a gateway built from this change: connect-time and scheduled refreshes succeed and the stable placeholder swaps under a running process; after uninstalling the app, a forced refresh parked the state as reauthorization_required with subtype invalid_refresh_token.
• mise run pre-commit equivalents pass (see above)
• Unit tests added/updated
• E2E tests added/updated (not applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; user docs added under how-it-works/providers)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.