feat(frontend): provider switcher for tracker intake (GitHub, Linear, Jira)

[anirudh5harma]

Summary

The desktop dashboard now exposes a provider switcher in project settings so a project can target GitHub, Linear, or Jira intake from the UI. Selecting a provider swaps the visible scope fields, scrubs any stale fields from the prior provider before save, and enforces per-provider validation. Sessions spawned by intake still surface a canonical <provider>:<native> badge on the board and inspector.

Closes #2283.

Depends on #2288. This branch is intentionally stacked on the backend branch; after #2288 merges it will be rebased onto main so the final diff contains only the frontend changes.

This ports aoagents/ReverbCode#425 and extends it to consume the multi-provider TrackerIntakeConfig shape introduced in #2288.

What this PR adds

• Provider <Select> (GitHub / Linear / Jira) inside the Tracker intake card. The provider field is required when intake is enabled.
• Provider-specific scope fields, shown conditionally:
  • GitHub → Repository (owner/repo, blank = git origin auto-derived)
  • Linear → Team key
  • Jira → Site URL + Project key
• Save scrubbing — repo, team, baseURL, projectKey are explicitly cleared from the payload before the new provider's scope fields are set, so a switch never leaks a stale field into the daemon.
• Per-provider validation — Linear without a team key and Jira without site URL + project key both block save with explicit messages. The existing label-or-assignee guard still applies across all three providers.
• Inline credential hint — a small caption under the form names the env vars the selected provider reads (AO_GITHUB_TOKEN / AO_LINEAR_TOKEN / AO_JIRA_EMAIL + AO_JIRA_TOKEN) so users know where to put credentials without leaving Settings. Restart-the-daemon caveat included.
• Provider-aware placeholders for labels / assignee (github login or * vs Linear display name vs Jira accountId or email).

Scope notes

• Credentials are env vars, daemon-side. The UI does not collect, edit, or display tokens.
• Live preflight / "credentials missing" status is intentionally inline-only (env-var hint). A live status endpoint can land later if needed.
• Dry-run previews, last-poll status, activity history, and dedicated pause/resume APIs remain future work.
• No polling, matching, or tracker writes run in Electron.

Validation

• Focused frontend suite for ProjectSettingsForm: 10 tests, all pass — covers GitHub save round-trip, Linear save, Jira save, Linear validation, Jira validation, broad-intake guard, hidden-config preservation, daemon error surfacing.
• Full frontend suite: 40 files, 379 tests, all green.
• npm run frontend:typecheck
• Manual visual pass deferred while canonical main has the pre-existing duplicate migration 20 panic; component-level coverage above is comprehensive.

Post-deploy monitoring

After #2288 lands, enable intake for one disposable project per provider and confirm:

• Settings reload exactly what was saved, no field bleed across provider switches.
• An eligible Linear / Jira issue produces a worker session with linear:ENG-N / jira:PROJ-N badges on the board.
• Switching provider in the UI clears the previous scope fields visually and on the next save payload.
• Inline env-var hint renders the correct vars per selection.

Rollback trigger: a switch silently leaving stale repo / team / projectKey in the saved payload, or settings save failing schema validation post-regen. Immediate mitigation: disable trackerIntake.enabled on the affected project.