feat: wire the Instagram connector into connect and publishing

The Instagram connector existed but was never registered, so Channels showed
it as "provider unavailable" and publishing could not resolve it.

- Register createInstagramConnector in the connections registry and the
  publishing registry; add the connector-runtime publishing policy
  (idempotency "none": media_publish has no key, never replay).
- The Facebook app credentials identify the Hub, not a collective: read them
  only from INSTAGRAM_CLIENT_ID / INSTAGRAM_CLIENT_SECRET. Drop the
  clientId/clientSecret connect fields and stop copying the app secret into
  each connection's vault entry. The provider is connectable only when both
  are set (connectEnabled + connectNote).
- Fail the connect when several Instagram accounts are granted instead of
  silently publishing as the first Page's account.
- Fix the connector package's pre-existing lint errors (it now ships in api).
- Tests: contract cases for env-only credentials and the multi-account
  refusal; connections integration case for provider gating and the
  Facebook dialog redirect.
- docs/oauth-connect.md: Instagram setup, callback URI and limits.

Not in this change: publishing images needs a public plaintext JPEG URL that
Meta downloads, and storage is client-side encrypted, so presigned S3 URLs
cannot serve it. Until a short-lived media endpoint exists, publishing to
Instagram fails with an explicit error. Token refresh via ig_refresh_token
on graph.facebook.com also needs checking against Facebook Login tokens.

apps/api/package.json

@@ -13,6 +13,7 @@
   "dependencies": {
     "@tactical-media-broadcast-hub/connector-sdk": "workspace:*",
     "@tactical-media-broadcast-hub/connector-telegram": "workspace:*",
+    "@tactical-media-broadcast-hub/connector-instagram": "workspace:*",
     "@tactical-media-broadcast-hub/core": "workspace:*",
     "@aws-sdk/client-s3": "^3.1146.0",
     "@aws-sdk/s3-request-presigner": "^3.1146.0",

apps/api/src/connections/connections.integration.test.ts

@@ -9,6 +9,8 @@ import { ConnectorRegistry } from "@tactical-media-broadcast-hub/connector-sdk";
 import { createMastodonConnector } from "../../../../packages/connector-mastodon/src/index.js";
 import { createTelegramConnector } from "@tactical-media-broadcast-hub/connector-telegram";
 import { createPeerTubeConnector } from "../../../../packages/connector-peertube/src/index.js";
+import { createInstagramConnector } from "@tactical-media-broadcast-hub/connector-instagram";
+import { connectionRegistry } from "./connector-registry.js";
 import { Vault, type SealedCredential } from "../vault/vault.js";
 import type { SessionPayload } from "../auth/session.js";
 import { RbacGuard } from "../rbac/rbac.guard.js";
@@ -105,12 +107,13 @@ describe("HTTP OAuth connect with real connectors and mock authorization server"
   let issued = 0;
   let failExchange = false;
   let bridgeConfigured = false;
+  let instagramConfigured = false;
   const botToken = "12345:bot_token_secret";
 
   beforeEach(() => {
     store.rows.clear(); store.audit.length = 0; store.authorized = true;
     redis.entries.clear(); activeTokens.clear(); grants.clear(); revokedTokens.length = 0;
-    nextAccount = "account-1"; issued = 0; failExchange = false; bridgeConfigured = false;
+    nextAccount = "account-1"; issued = 0; failExchange = false; bridgeConfigured = false; instagramConfigured = false;
     warn.mockClear(); info.mockClear();
   });
 
@@ -180,6 +183,9 @@ describe("HTTP OAuth connect with real connectors and mock authorization server"
         }));
         const botFetch: typeof fetch = (input, init) => fetch(String(input).replace("https://api.telegram.org", origin), init);
         registry.register(createTelegramConnector({ credentials, fetchImpl: botFetch, requestsPerSecond: 100_000 }));
+        registry.register(createInstagramConnector({ credentials, fetchImpl: mockFetch, requestsPerSecond: 100_000,
+          env: instagramConfigured ? { INSTAGRAM_CLIENT_ID: "hub-app-id", INSTAGRAM_CLIENT_SECRET: "hub-app-secret" } : {},
+        }));
         return registry;
       },
     };
@@ -342,6 +348,25 @@ describe("HTTP OAuth connect with real connectors and mock authorization server"
     bridgeConfigured = false;
   });
 
+  it("offers Instagram only with the Hub's Facebook app configured, and keeps the app secret out of the browser", async () => {
+    expect(connectionRegistry({} as never).has("instagram")).toBe(true);
+    const providersOf = async () => await (await api("/providers")).json() as Array<{ id: string; enabled: boolean; note?: string }>;
+    expect((await providersOf()).find((provider) => provider.id === "instagram")).toMatchObject({ enabled: false, note: expect.stringContaining("INSTAGRAM_CLIENT_ID") });
+    expect((await api("/authorize", "POST", { provider: "instagram" })).status).toBe(400);
+    instagramConfigured = true;
+    expect((await providersOf()).find((provider) => provider.id === "instagram")?.enabled).toBe(true);
+    const response = await api("/authorize", "POST", { provider: "instagram" });
+    expect(response.status).toBe(201);
+    const { redirectUrl } = await response.json() as { redirectUrl: string };
+    const dialog = new URL(redirectUrl);
+    expect(dialog.origin + dialog.pathname).toBe("https://www.facebook.com/v21.0/dialog/oauth");
+    expect(dialog.searchParams.get("client_id")).toBe("hub-app-id");
+    expect(dialog.searchParams.get("redirect_uri")).toBe(`${apiOrigin}/connections/callback`);
+    expect(dialog.searchParams.get("state")).toMatch(/.{32,}/);
+    expect(redirectUrl).not.toContain("hub-app-secret");
+    instagramConfigured = false;
+  });
+
   it("sets, validates and clears per-connection publish governance", async () => {
     await finish(await begin());
     const id = (await listed())[0]?.id ?? "";

apps/api/src/connections/connector-registry.ts

@@ -1,5 +1,7 @@
 import { ConnectorRegistry, type CredentialAccessor } from "@tactical-media-broadcast-hub/connector-sdk";
 // eslint-disable-next-line no-restricted-syntax -- Connector composition boundary.
+import { createInstagramConnector } from "@tactical-media-broadcast-hub/connector-instagram";
+// eslint-disable-next-line no-restricted-syntax -- Connector composition boundary.
 import { createMastodonConnector } from "@tactical-media-broadcast-hub/connector-mastodon";
 // eslint-disable-next-line no-restricted-syntax -- Connector composition boundary.
 import { createPeerTubeConnector } from "../../../../packages/connector-peertube/src/index.js";
@@ -13,5 +15,6 @@ export function connectionRegistry(credentials: CredentialAccessor, fetchImpl: t
   registry.register(createMastodonConnector(options));
   registry.register(createPeerTubeConnector(options));
   registry.register(createTelegramConnector(options));
+  registry.register(createInstagramConnector(options));
   return registry;
 }

apps/api/src/publishing/publishing.service.ts

@@ -1,5 +1,7 @@
 import { BadRequestException, ForbiddenException, Inject, Injectable, NotFoundException, Optional, ConflictException } from "@nestjs/common";
 // eslint-disable-next-line no-restricted-syntax -- Connector composition boundary.
+import { createInstagramConnector } from "@tactical-media-broadcast-hub/connector-instagram";
+// eslint-disable-next-line no-restricted-syntax -- Connector composition boundary.
 import { createMastodonConnector } from "@tactical-media-broadcast-hub/connector-mastodon";
 import { isPublishingProvider, providerFetch } from "@tactical-media-broadcast-hub/connector-runtime";
 import { ConnectorRegistry, type CredentialAccessor, type PlatformConnector } from "@tactical-media-broadcast-hub/connector-sdk";
@@ -129,6 +131,7 @@ function connectorFor(provider: string): PlatformConnector {
     };
     registry.register(createMastodonConnector(options));
     registry.register(createTelegramConnector(options));
+    registry.register(createInstagramConnector(options));
     return registry;
   })();
   return publishingConnectors.get(provider);