Add deployment-wide Notion access modes

[mrubens]

Summary

• make Notion an admin-managed deployment OAuth connection available to interactive tasks and automations
• add a deployment access setting with fail-closed read-only behavior by default and an explicit read-write option
• enforce the effective policy for both tool discovery and direct tool calls while preserving individual disabled-tool overrides
• update the integrations UI, onboarding, setup guidance, Slack recommendations, public docs, and release notes

Rollout

The schema migration is additive. Existing personal Notion credentials are not promoted automatically; an administrator reconnects Notion once from Settings > Integrations. Missing or invalid access-mode values resolve to read-only.

Validation

• pnpm lint
• pnpm check-types
• pnpm knip
• pnpm --filter @roomote/docs check
• Drizzle migration consistency check
• focused types, API, web, Slack, worker, and cloud-agent tests (165 tests)

[roomote-community]

No code issues found. See task

• Update the SDK MCP connection-router tests for Notion's deployment scope; the affected package test file currently has five failures.

_{Reviewed bd23346}