feat(control-center): add Integrations status page (PR-B6)

[man4ish]

Summary

Replaces the Platform → Integrations "Coming Soon" placeholder with a real, read-only status page for the third-party integrations already wired into this deployment's own docker-compose: Sentry (SDK crash reporting + Ecosystem Report error aggregation) and the two independent Discord webhook targets (general notifications, known-issue alerts).

Full Phase 1 discovery + architecture decision is in this PR's own conversation record. Short version: no Integration model, CRUD API, or credential-management mechanism exists anywhere in the ecosystem (16+ repos inspected). The only concrete, evidenced third-party integrations are the three above (found by reading omnibioai-studio/docker-compose.yml's actual deployment service blocks, not guessed). Everything else adjacent (GlobalConfig LLM/cloud provider, compute backends) is already fully surfaced by the existing Settings/Cloud pages — this PR does not duplicate them.

Scope

• No CRUD, credential input, connection-test button, new permission, database migration, or Gateway involvement — none of these have any backend capability anywhere to build against.
• Read-only, env-var-presence-only, platform-wide — same architecture as the existing GET /cloud (routes_cloud.py), same ungated-at-router-level posture for the same reason (booleans/labels only, no internal topology, no credential values).

Backend

• routes_integrations.py: GET /integrations, reads SENTRY_DSN/SENTRY_API_TOKEN/SENTRY_ORG/SENTRY_PROJECT_SLUGS/DISCORD_WEBHOOK_URL/DISCORD_ALERT_WEBHOOK_URL at request time (testable via patch.dict(os.environ, ...), same convention routes_cloud.py established).
• 14 new tests: shape, per-integration independence, Sentry's AND-gated report_aggregation_configured, explicit "no auth required" assertion, dedicated secret-leakage test.

Frontend

• integrations.ts: typed data layer, mirrors platform_config.ts.
• IntegrationsPage.tsx: flat page (no org picker, no tabs), reuses Card/SectionHeader/LoadingState/ErrorState/EmptyState/StatusBadge. Every card explicitly states why Configure/Test/Rotate aren't offered.
• navigation.ts: integrations flipped to functional: true, same hasAdminAccess gate as Cloud/RAG/Settings.
• StatusBadge: added configured/not_configured vocabulary (small additive change, same pattern as its existing revoked/expired extension).
• 14 new IntegrationsPage tests + nav-placement tests + 3 AdminApp route-guard tests. Retired the old "renders Coming Soon for an unimplemented module (e.g. Integrations)" test — after this PR, navigation.ts has no remaining functional: false entry.

Deployment

One new nginx location /integrations (no SPA route collision, same as /sessions//rag). No compose, env var, migration, or new-service changes — everything read here is already set on control-center's own existing container in production.

Explicitly untouched

omnibioai-auth, JWT, Sessions, Interactions, B5-A/B, RAG producers, interaction worker, Redis streams, API Gateway, database schemas, secret storage, billing, security-audit.

Tests

• Backend: 933/933 passed (full suite), 14/14 new.
• Frontend: 421/421 passed (34 files, full suite), 14/14 new IntegrationsPage + nav/AdminApp additions.
• tsc -b: clean.
• git diff --check: clean.

🤖 Generated with Claude Code