[Feat] Guide self-hosted Linear OAuth setup

[daniel-lxs]

Summary

• add an admin-guided Linear OAuth setup dialog backed by Linear’s pre-filled app manifest
• use the same hostname-derived app name and default description as the GitHub setup
• show setup only while Linear OAuth is missing or incomplete, with the same administrator requirements and status language as GitHub
• store self-hosted client and webhook credentials in the encrypted deployment environment while keeping runtime environment variables authoritative
• resolve saved credentials in the OAuth and webhook paths, and replace legacy dynamically registered clients during reconnect
• require an existing workspace to reconnect when its OAuth client changes so old refresh tokens are not reused
• document the new self-hosted flow

User flow

1. An administrator selects Set it up when Linear OAuth is missing or incomplete.
2. Roomote opens Linear’s private app form with the shared roomote- name plus the callback URL, webhook URL, and AgentSessionEvent subscription pre-filled.
3. The administrator copies the client ID, client secret, and webhook secret back into Roomote.
4. Roomote encrypts the values and exposes Enable Linear. If client credentials replaced an existing app, the old workspace connection is cleared and must be approved again.

Non-admins see the same contact-an-administrator guidance used by GitHub. Deployments configured through runtime environment variables keep using those values and do not expose a setup action.

Linear still differs where its platform requires it: its manifest creates a private app and Linear requires the generated credentials to be copied back manually.

Screenshots

Missing Linear credentials

Guided setup

Validation

• pnpm lint
• pnpm check-types:fast
• pnpm knip
• 79 focused web tests covering shared app naming, setup UX, manifest generation, encrypted credential resolution, and legacy OAuth client replacement
• 11 focused Linear API tests covering webhook secret resolution and routing behavior
• clean-restarted the web service and verified both local and public integration pages return 200

[roomote-roomote]

1 issue outstanding. See task

• apps/web/src/components/settings/Integrations.tsx:1143-1150, 1292-1349 OAuth setup is only queried and exposed while readiness is missing or partial. Once the credentials are valid, an administrator has no UI route to rotate a saved client secret or webhook secret (or replace the OAuth app), despite the dialog and server mutation supporting those updates. Keep an edit/credential-management action available for saved, non-runtime-managed credentials.

_{Reviewed db68f4b}