Credential-free connectors and a default helper library

Connector setup without secrets, a default helper library, and tighter controls for admins all land in this release.

Credential-free connector setup: the agent can now create API-key and OAuth connectors, up to 20 in a batch, with no secret anywhere in the conversation. Each one comes back with a dashboard link where an admin enters the credential.
132 ready-made helpers across 19 connectors, including Google Workspace, Slack, GitHub, Notion, Jira and HubSpot, each kept within that connector's default scopes. Helpers are opt-in per organization.
Three-layer URL containment on helpers: checked when a helper is saved, enforced in the sandbox at run time, and enforced again by the proxy.
Redaction settings via MCP: org admins can read and update PII redaction rules from the AI client, with merge semantics so existing rules are never overwritten.
Per-web-app audit: every call an org web app makes is logged as its own row and attributed to that app in API usage.