feat(extensions): add authenticated Xquik MCP integration

[kriptoburak]

Summary

Allow bundled Streamable HTTP integrations to authenticate through OpenFang's credential resolver. Add Xquik as the first remote HTTP integration.

The template model already supported HTTP transports. The generated MCP config always discarded authentication headers, so any authenticated remote template connected without credentials. An unauthenticated request to the Xquik MCP endpoint reproduces this as 401 Unauthorized.

Changes

• Add credential-backed header templates for remote MCP integrations.
• Resolve header values through the existing vault, dotenv, and environment chain.
• Keep credentials out of bundled TOML files and setup output.
• Add the Xquik Streamable HTTP template for public X post search.
• Validate that every bundled header references a declared credential.
• Cover transport selection and bearer-header generation with a regression test.

Testing

• cargo fmt --all -- --check
• cargo clippy -p openfang-extensions --all-targets -- -D warnings
• cargo test -p openfang-extensions --lib (55 passed)
• cargo check -p openfang-kernel --lib
• cargo test --workspace passes
  • The complete workspace compiled. All displayed API, channel, CLI, desktop, extension, and hand suites passed. I stopped the runner before the kernel suite when its build output exceeded the local storage budget. CI should run the complete workspace matrix.
• Live integration tested
  • The public docs and setup URLs return 200. The MCP endpoint returns the expected 401 without credentials. No real API key or production request was used.

Security

• No new unsafe code
• No secrets or API keys in diff
• User input validated at boundaries

Header templates contain only a header name, static prefix, and credential key. OpenFang resolves the value at runtime and keeps the existing HTTP header parser as the validation boundary.

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.