feat(operator): embed Slack personal MCP authentication

[edwin-zvs]

Summary

• remove mcp_command from the operator protocol, persisted config, daemon validation, TUI editor, and web editor
• start Slack hosted MCP through pinned mcp-remote@0.1.38, using Slack official endpoint/client metadata, a fixed localhost callback, scoped OAuth, and daemon-owned credential storage
• keep OAuth status truthful: summaries report only whether a non-empty token record is persisted; first use clearly reports that browser authorization is opening
• adapt the existing sweep/read/send/draft contract to hosted native tools and detailed result formats: slack_search_public_and_private, slack_read_thread, slack_send_message, and slack_send_message_draft
• support hosted JSON-in-text and structuredContent, detailed search/thread rendering, pagination cursors, workspace hosts from permalinks, and sent timestamps from message links
• preserve adaptive polling, auto-after human-reply yielding, and exact per-channel response-mode overrides
• update specs 0201 and 0202 for the embedded hosted backend, OAuth semantics, hosted schemas, polling, and delayed-send behavior

Integration

• based on origin/main at 80655ab (test(tui): cover CJK playbook editing geometry #1279)
• preserves adaptive polling from feat(operator): adapt Slack personal polling cadence #1275
• preserves auto-after from feat(operator): add delayed Slack personal replies #1276
• preserves exact response-mode overrides from feat(operator): add Slack personal response-mode overrides #1277, including CHANNEL=auto-after round-trip and runtime resolution

Contract verification

• endpoint, OAuth client ID, and callback port checked against slackapi/slack-skills-plugin commit 77a10794d6fc2be6cc62261b28447ef27c0f3fff
• pinned proxy flags and MCP_REMOTE_CONFIG_DIR token layout checked against the published mcp-remote@0.1.38 package
• focused adapter tests exercise the hosted native tool names, exact call arguments, detailed text-JSON result schemas, structuredContent, pagination, thread history, draft/send delivery, and permalink timestamp decoding

Validation

• cargo test -p construct-daemon operator:: — 138 passed
• cargo test -p construct-daemon operator_supervisor — 13 passed
• cargo test -p construct-daemon web_slack_personal_editor_uses_embedded_oauth_and_all_current_behaviors — 1 passed
• cargo test -p construct-cli slack_personal — 3 passed
• cargo test -p construct-protocol operator_protocol_tests — 3 passed
• cargo test -p construct-e2e --test web_smoke web_operator_editor_round_trips_slack_personal_response_mode_overrides — 1 passed
• cargo build — passed

No recording: this is backend/operator-channel behavior; the editor changes only remove command input and clarify OAuth state.