[Feat] Add deployment-wide Granola integration

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Adds Granola as a deployment-wide, admin-configured integration backed by an encrypted Granola API key.
• Provides native read-only MCP tools for listing notes, reading note details and transcripts, and browsing folders through Granola's official API.
• Recommends a workspace API key and documents its access to public notes and API-enabled spaces, including Granola's new-space default. A personal-key fallback must have Public notes selected and Personal notes left unchecked.
• Adds setup recommendations, Slack shared-note URL detection, dashboard setup and branding, focused tests, and public documentation.

Why this change was made

Meeting notes often contain decisions, action items, and implementation context that agents need while planning and completing work. A deployment-owned API connection makes approved team context available across Roomote tasks without sharing individual OAuth access.

Impact

Deployment operators connect Granola once from Settings > Integrations. Roomote can browse only the notes, folders, and transcripts allowed by that key; it does not expose Granola note mutations or webhook-management operations.

Screenshots

[roomote-community]

No code issues found. See task

• packages/types/src/mcp-oauth.ts:489 Granola's protected-resource metadata advertises only the mcp scope, but oauthScopeMode: 'read-only' causes the OAuth initiator to filter that scope out. The dynamic registration and authorization redirect therefore omit scope=mcp, so the new connector does not request its advertised MCP access. Define Granola's required mcp scope explicitly (or preserve resource scopes in the read-only filter) and cover this flow with an OAuth initiation test.

_{Reviewed d6d009d}