feat(integrations): add Xquik MCP and guard duplicate IDs

[kriptoburak]

• A human has tested these changes.

---

Why

OpenHands does not yet list Xquik in its integration catalog. Xquik provides a remote Streamable HTTP MCP endpoint with OAuth 2.1 and a client-specific API-key fallback.

The catalog generator also accepted duplicate integration IDs. It could emit an ambiguous JavaScript catalog before the Python package rejected the source files.

Summary

• Add Xquik with OAuth 2.1 discovery metadata, PKCE, dynamic registration, the mcp:tools scope, and required resource parameters.
• Keep an explicit bearer-token option for clients with secure API-key storage.
• Reject duplicate integration IDs before generating catalog-index.js.
• Cover the generator failure with a focused regression test.

Issue Number

No linked issue.

How to Test

uv sync --group test
uv run pytest -q
npm run build
uv run python scripts/sync_extensions.py --check
GITHUB_TOKEN="<approved token>" uv run python scripts/sync_openhands_sdk_skill.py --check

Local results after rebasing onto current main (f887f19):

• 500 tests passed; 6 opt-in live integration tests skipped.
• Every generated catalog rebuilt without a diff.
• Both repository sync checks passed.
• The duplicate-ID regression confirms the generator exits before writing an index.
• Xquik MCP, OAuth metadata, documentation, and icon URLs passed live checks.
• Both rebased commits have valid GitHub SSH signatures.

CI Note

Fork workflows require maintainer approval. Earlier Tests, Deprecation deadlines, and Check Extensions runs therefore contained 0 jobs. The PR-title checks passed.

Video/Screenshots

Not applicable. This changes catalog metadata and generator validation.

Notes

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.