feat: Multi-provider OAuth integration patterns (GitHub, Google, Notion, etc.)

[aecs4u]

Summary

Implement reusable OAuth 2.0 integration patterns for connecting to third-party services (GitHub, Google Workspace, Notion, Jira, etc.) that agent tools can use for authenticated API access.

Prior Art

• AutoGPT implements OAuth integrations for 7+ providers (GitHub, Google, Notion, Discord, Twitter, Reddit, Medium) with a unified OAuth flow — users authenticate once via browser redirect, tokens are stored encrypted, and auto-refreshed. Each integration becomes available as blocks (tools) the agent can use.
• RustyClaw already has feat: OAuth 2.1 support for LLM provider authentication #72 (OAuth 2.1 for LLM provider auth), but this covers OAuth for service integrations rather than LLM providers.

Motivation

RustyClaw agents frequently need to interact with external services — reading GitHub issues, updating Notion pages, accessing Google Drive files. Currently, users must manually provide API tokens via the secrets vault. A built-in OAuth flow would make authentication seamless and handle token refresh automatically.

Proposed Design

1. OAuth 2.0 PKCE flow with local callback server:

   struct OAuthProvider {
       name: String,
       auth_url: String,
       token_url: String,
       scopes: Vec<String>,
       client_id: String,
   }

2. rustyclaw auth connect <provider> CLI command opens browser for OAuth
3. Tokens stored in the encrypted secrets vault (reuse existing AES-256-GCM)
4. Auto-refresh before expiration
5. Built-in provider configs for common services:
   • GitHub (repos, issues, PRs)
   • Google (Gmail, Drive, Calendar)
   • Notion (pages, databases)
6. Tools can request OAuth tokens by provider name:

   let token = vault.get_oauth_token("github").await?;

Acceptance Criteria

• OAuth 2.0 PKCE flow with local callback server
• CLI command rustyclaw auth connect <provider>
• Token storage in encrypted secrets vault
• Automatic token refresh
• At least 3 built-in provider configurations (GitHub, Google, Notion)
• Tools can request tokens by provider name

Related Issues

• feat: OAuth 2.1 support for LLM provider authentication #72 (OAuth 2.1 for LLM providers — complementary, different scope)
• feat: Secure credential memory with zeroize/secrecy crate #86 (Secure credential memory with zeroize)