Add a File Search plugin endpoint with folder setup during authorization - #1486

Summary

A second plugin for OpenAI's plugin directory, for File Search only. The database plugin on /mcp/chatgpt-app is in review and stays untouched. The earlier submissions were rejected as a relay of third-party integrations; File Search has nothing third-party behind it, and the folder setup runs while ChatGPT is being connected, so the reviewer sees a complete workflow.

Changes

• POST /mcp/file-search: 8 fixed tools (list_file_sources, search_documents, find_files, list_folder, read_document, find_exact_text, view_document_page, get_file_link), each mapped to one FILE_SEARCH built-in by its endpoint method and run through deps.execute (scope, role, folder rules, audit). Only File Search sources; no catalog connectors, databases, File Share or share_file. All hints explicit; only get_file_link is not read-only (it stores a members-only link). Searches run over every folder when no source is given.
• OAuth: ResourceIndicatorMiddleware sets a signed mcp_app cookie when resource is /mcp/file-search (the server-id cookie is unchanged). After Approve, an ADMIN of a workspace without an active File Search folder gets "Connect a folder for " with the protocols and NAS presets; otherwise the flow goes straight back. The first-connector page is unchanged for every other client.
• POST /auth/file-search/session: dashboard session on the granted workspace plus the wizard path for a fixed option. Needs the page's CSRF token and cookie, the dashboard header, the pending login cookie, an authorization that asked for /mcp/file-search, the recent sign-in of the same user, and ADMIN. GET /auth/file-search/continue finishes the paused authorization, or says how to go on when it expired.
• Frontend: public hand-off page /setup/file-search; the wizard's return=authorize mode (banner with Skip, granted servers preselected, back to the authorization after Activate). Without the parameter the wizard is unchanged. New fileSearch.authorize strings in EN/DE/IT.
• Product event file_search_authorize_offered (server-only); wizard entry point authorize.
• Plugin package deploy/openai-plugins/file-search/ (manifest with listing, keywords, 5+3 test cases on the demo bucket, onboarding skill, icon). No "MCP" in the plugin name.
• Docs: docs/integrations/chatgpt.md section; llms-full.txt regenerated.

Cloud and self-hosted behave the same; on a self-hosted Community edition the wizard shows its File Search trial/licence state. The network-folder option is offered on self-hosted only. No schema change.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

Commands and results:

• packages/backend: npx prisma generate, npx tsc --noEmit -p tsconfig.json passed; npx eslint on the changed files: no findings; npx jest --maxWorkers=4: 996 suites passed (6 skipped), 30,473 tests passed.
• New specs: file-search-app-toolset.spec.ts (11), file-search-app.controller.spec.ts (7), login.controller.file-search.spec.ts (16), additions to resource-indicator.middleware.spec.ts. Existing login, server picker and social login specs unchanged and passing.
• packages/frontend: npx tsc --noEmit -p tsconfig.json passed; npx eslint on the changed files: no errors, 3 warnings that exist on main.
• node scripts/generate-llms-txt.mjs --check: fresh.

Manual, local backend built from this branch (port 4400, own database) and next dev on 3400:

• Scripted OAuth run, 27 of 27 checks: 401 with resource_metadata for /mcp/file-search; DCR client; /authorize with resource=…/mcp/file-search sets mcp_app; Approve shows the setup page with every protocol; hand-off refused without header, with a wrong CSRF token, with an unknown option; accepted for Nextcloud with the granted server; the session works on /api/file-search/capabilities; continue → /callback → code → token; tools/list returns the 8 tools; list_file_sources without a folder returns the wizard link; /mcp/chatgpt-app still lists its 8 tools; the database plugin's authorization goes straight to /callback.
• In Chrome: sign-in and "Allow access" (existing session) both show the setup page; Synology opens the wizard signed in, with the banner and return=authorize&servers=… kept in the URL.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title

Related Issues

Fixes #1485