Notion OAuth foundation + canvas menu/connector fixes

Added

• Notion OAuth foundation (plan Phase 2):
  • lib/notion.ts — authorize-URL builder, code→token exchange, and a minimal authenticated notionApi() helper (basis for import/export).
  • Routes under app/api/integrations/notion/: connect (CSRF state cookie → Notion consent), callback (verify state, exchange code, upsert token via the service-role client), status (connection state for the panel), disconnect.
  • components/IntegrationsPanel.tsx — NotionControl reflects live status (Connect / Connected · workspace / Disconnect), fetched on panel open.
  • .env.example documents NOTION_CLIENT_ID / NOTION_CLIENT_SECRET.

Fixed

• Context menu now dismisses on left-click: the outside-click listener moved to capture phase (React Flow swallowed the bubble-phase event), plus an onPaneClick close on the canvas.

Changed

• Easier node connections — connectionRadius={48}, connectOnClick, a larger invisible handle hit area (::before inset), and handles surface while dragging a connection.
• Supabase types regenerated from the linked DB (supabase gen types), replacing the hand-written lib/supabase/types.ts so .from()/upsert type correctly.

Notes

• supabase-js@2.48 mis-infers typed .select() results as never against the generated types' PostgREST version; the Notion status route casts the row. Follow-up: bump @supabase/supabase-js to realign select typing.
• Notion connect needs SUPABASE_SECRET_KEY set (callback writes tokens via the admin client) and the redirect URI registered on the Notion integration.