apify tool, tools API + automation UI, integrations config, super admin restrictions

- apify tool: TOOL.md definition, index.ts implementation with auto-auth via OFFICER_APIFY_TOKEN, output_path for large datasets
- tools API: /tools routes (list, detail, chat, create, delete) mirroring tasks pattern
- automation UI: tools tab in sidebar, NewTool component, tool detail view
- apify integration: settings page for enterprise API key config, pi-bridge passes env var to containers
- tiktok-trends task: rewritten as agent instructions using apify tool with output_path, scripted report generation for 50KB read limit
- restrict edit/delete of native/global capabilities to Super Admin only (backend + frontend)
- tools authoring guide: TOOLS.md with full spec for TOOL.md frontmatter, index.ts execute signature, patterns

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/servers/api/pi/pi-bridge.ts

@@ -190,6 +190,16 @@ async function ensureGoogleTokenFile(userId: number, email: string): Promise<str
   return filePath;
 }
 
+async function getApifyToken(): Promise<string> {
+  try {
+    const integration = await getServerIntegration('apify');
+    const config = integration?.config as Record<string, string> | undefined;
+    return config?.apiToken ?? '';
+  } catch {
+    return '';
+  }
+}
+
 async function getBrowserRelayEnv(userId: number): Promise<Record<string, string>> {
   const port = getRelayPort();
   if (!port) return {};
@@ -265,6 +275,7 @@ export async function spawnPi(
     const googleConfigHost = await ensureGoogleConfigFile();
     await ensureGoogleTokenFile(sandbox.userId, sandbox.email);
     const browserRelayEnv = await getBrowserRelayEnv(sandbox.userId);
+    const apifyToken = await getApifyToken();
 
     const envFlags = [
       '-e', `HOME=${containerHome}`,
@@ -276,6 +287,7 @@ export async function spawnPi(
       '-e', `OFFICER_GOOGLE_CONFIG_PATH=/officer/google-oauth.json`,
       '-e', `OFFICER_GOOGLE_TOKEN_PATH=/officer/user/integrations/google.json`,
       '-e', `OFFICER_EMAIL_DB=/officer/emails.db`,
+      ...(apifyToken ? ['-e', `OFFICER_APIFY_TOKEN=${apifyToken}`] : []),
       ...Object.entries(browserRelayEnv).flatMap(([k, v]) => ['-e', `${k}=${v}`]),
     ];
 
@@ -321,6 +333,7 @@ export async function spawnPi(
     const googleConfigPath = await ensureGoogleConfigFile();
     const googleTokenPath = await ensureGoogleTokenFile(userId, email);
     const browserRelayEnv = await getBrowserRelayEnv(userId);
+    const apifyTokenLocal = await getApifyToken();
 
     proc = Bun.spawn(args, {
       cwd,
@@ -339,6 +352,7 @@ export async function spawnPi(
         OFFICER_GOOGLE_CONFIG_PATH: googleConfigPath,
         OFFICER_GOOGLE_TOKEN_PATH: googleTokenPath,
         OFFICER_EMAIL_DB: join(DATA_PATH, email, 'emails.db'),
+        ...(apifyTokenLocal ? { OFFICER_APIFY_TOKEN: apifyTokenLocal } : {}),
         ...browserRelayEnv,
       },
     });