feat(slack): add Slack integration with @mention-based task submission

Adds full Slack integration enabling users to submit coding tasks by
mentioning @shoof in any channel or DM, with real-time emoji reactions
and threaded notifications showing task progress.

Key features:
- @mention task submission with natural language repo extraction
- Emoji reaction progression: 👀 → ⌛ → ✅
- Threaded notifications (created, started, completed/failed)
- Cancel button with instant feedback
- DM support for private task submissions
- OAuth multi-workspace install flow
- `bgagent slack setup` CLI wizard for zero-friction onboarding
- Account linking via /bgagent link

New files:
- CDK constructs: SlackIntegration, SlackInstallationTable, SlackUserMappingTable
- Lambda handlers: events, commands, command-processor, interactions,
  oauth-callback, link, notify
- Shared utilities: slack-verify, slack-blocks
- CLI: slack.ts (setup, link commands)
- Docs: SLACK_SETUP_GUIDE.md with screenshots

Author: isadeks

cdk/src/constructs/slack-installation-table.ts

@@ -0,0 +1,77 @@
+/**
+ *  MIT No Attribution
+ *
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy of
+ *  the Software without restriction, including without limitation the rights to
+ *  use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ *  the Software, and to permit persons to whom the Software is furnished to do so.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ *  SOFTWARE.
+ */
+
+import { RemovalPolicy } from 'aws-cdk-lib';
+import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import { Construct } from 'constructs';
+
+/**
+ * Properties for SlackInstallationTable construct.
+ */
+export interface SlackInstallationTableProps {
+  /**
+   * Optional table name override.
+   * @default - auto-generated by CloudFormation
+   */
+  readonly tableName?: string;
+
+  /**
+   * Removal policy for the table.
+   * @default RemovalPolicy.DESTROY
+   */
+  readonly removalPolicy?: RemovalPolicy;
+
+  /**
+   * Whether to enable point-in-time recovery.
+   * @default true
+   */
+  readonly pointInTimeRecovery?: boolean;
+}
+
+/**
+ * DynamoDB table for Slack workspace installations.
+ *
+ * Schema: team_id (PK) — one record per installed Slack workspace.
+ * Stores workspace metadata and a pointer to the bot token in Secrets Manager.
+ * Bot tokens are stored in Secrets Manager at `bgagent/slack/{team_id}`.
+ */
+export class SlackInstallationTable extends Construct {
+  /**
+   * The underlying DynamoDB table.
+   */
+  public readonly table: dynamodb.Table;
+
+  constructor(scope: Construct, id: string, props: SlackInstallationTableProps = {}) {
+    super(scope, id);
+
+    this.table = new dynamodb.Table(this, 'Table', {
+      tableName: props.tableName,
+      partitionKey: {
+        name: 'team_id',
+        type: dynamodb.AttributeType.STRING,
+      },
+      billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,
+      timeToLiveAttribute: 'ttl',
+      pointInTimeRecoverySpecification: {
+        pointInTimeRecoveryEnabled: props.pointInTimeRecovery ?? true,
+      },
+      removalPolicy: props.removalPolicy ?? RemovalPolicy.DESTROY,
+    });
+  }
+}