feat(apps): add Stripe connector - #465

I have read the CONTRIBUTING.md file.

YES

What kind of change does this PR introduce?

Feature — a new app connector. Closes #274.

What is the current behavior?

Stripe is not in the app catalog, so agents can only reach the Stripe API by handing them a raw secret key — exactly what the gateway exists to avoid. #274 asks for a connector covering charges/payment intents, Stripe Connect (accounts, onboarding status, payouts), disputes/refunds, and webhook event inspection.

What is the new behavior?

A Stripe connector following the existing api_key shape (cf. Resend / Fly.io):

• Connection: a secret or restricted key (sk_... / rk_...), stored encrypted and injected by the gateway as a Bearer token on api.stripe.com and files.stripe.com (Stripe's file-upload host, same auth). The form nudges users toward restricted keys scoped to what their agent needs.
• Metadata: resolved from GET /v1/account (dashboard display name → business profile name → email → account id). Non-fatal — restricted keys without Account read still connect.
• Permission catalog: read tools for charges, payment intents, Connect accounts, payouts, disputes, refunds, customers, balance/balance transactions, and webhook events; write tools for managing payment intents, charges, refunds, disputes, payouts, Connect accounts, and customers. Stripe's API uses GET for reads and POST/DELETE for all mutations (no PUT/PATCH), so the GET /v1/* read umbrella and POST+DELETE /v1/* write umbrella are true supersets of their groups — the read- and write-wildcard coverage suites verify this (181 apps tests pass locally).
• Gateway: declarative AppProvider entry with Bearer host rules for both hosts, plus unit tests mirroring the Resend ones (providers_for_stripe_hosts, stripe_api_uses_bearer, stripe_files_host_uses_bearer).
• Dashboard: catalog card (Development category) with light/dark icons (Simple Icons, CC0).

Additional context

• labelHint suggests "live" / "test" — the natural multi-account split for Stripe (test-mode vs live-mode keys as separate connections).
• The permission catalog intentionally leaves the rarely-agent-relevant surfaces (Products, Prices, Subscriptions, Billing) to the umbrellas rather than enumerating everything; happy to extend if you'd like explicit tools for those too.