feat: add bearer token connections

[shreyanshjain7174]

What changed:

• Adds POST /admin/tokens for connecting a bearer token to an existing user and registered bearer service.
• Restricts the endpoint to configured bearer services, so OAuth services retain their authorization-code flow.
• Stores tokens using the existing AES-GCM encrypted vault and returns 204 with no token body.
• Wires the endpoint into the production command and documents it for Slack, Stripe, and Calendly.

Verification:

• go test ./tests/integration -run TestIntegration_AdminConnectBearerToken -count=1 -v
• go test ./... -race -count=1
• go vet ./...
• semgrep scan --config p/default internal/admin/handler.go cmd/agentgw/main.go tests/integration/gateway_test.go
• git diff --check

All passed locally. Semgrep reported 0 findings.

[Copilot]

Pull request overview

Adds an admin endpoint to connect bearer tokens to existing users for configured bearer services. This fits the gateway model where the vault stores credentials and the proxy injects them upstream.

Changes:

• Add POST /admin/tokens admin endpoint to store bearer tokens in the existing encrypted vault.
• Gate the endpoint to services configured with auth.type: bearer.
• Add integration tests and README docs for the new endpoint. Wire the route in cmd/agentgw.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
tests/integration/gateway_test.go	Adds integration coverage for connecting a bearer token and dispatching an action using it.
README.md	Documents POST /admin/tokens behavior and request shape.
internal/admin/handler.go	Implements ConnectBearerToken and plumbs Registry into the admin handler.
cmd/agentgw/main.go	Wires the new admin route into the production server.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.