[Feat] Bind private integrations to private Sessions

[roomote-roomote]

​Opened on behalf of @daniel-lxs. Follow up by mentioning @roomote-roomote, in the web UI, or in Telegram.

What changed

• Add provider-neutral shared | private integration data policy; all existing integrations remain shared.
• Filter and re-authorize private integrations against the immutable Session owner before audit/execution.
• Omit private arguments, results, and provider errors from canonical history and durable audits.

Why this change was made

Credential ownership and data confidentiality are separate; future private providers must opt into the Session boundary.

Impact

No existing integration is reclassified and no connector is added.

Related PRs

• #2635 — Private Session access foundation
• #2637 — Shared Brain exclusion
• #2638 — Privacy inheritance
• #2642 — Shared egress blocking
• #2643 — Lifecycle and creation UI

[roomote-community]

1 issue outstanding. See task

• Preserve dataPolicy when returning discovered Fast integrations so private integrations remain restricted and redacted.

_{Reviewed 5f67a6f}

[roomote-community]

dataPolicy is computed here but is dropped when candidates are converted into the returned FastAgentIntegration objects at lines 595-609. Consequently a catalog-discovered private integration reaches the Fast service with dataPolicy === undefined, so the private-session filter, broker owner check, transcript redaction, and audit redaction all treat it as shared. Forward the policy in that return object and cover the discovery path; the current test only passes a manually constructed private integration directly to the broker.