refactor: move factcloud from hardcoded SSM to per-user DynamoDB oauth2_m2m connection

- Add oauth2_m2m auth type to mcp_loader.py (client_secret in record, not SSM)
- Remove _get_factcloud_token(), FACTCLOUD_* config, factcloud_clients from main.py
- Seed Daniel's factcloud connection into enrolled_services.mcp_connections
- factcloud now loaded dynamically via mcp_loader at session start

agentclaw/app/agent_claw_main/mcp_loader.py

@@ -45,12 +45,40 @@ def _get_oauth_token(conn: dict, actor_id: str) -> str:
     return token
 
 
+def _get_m2m_token(conn: dict, actor_id: str) -> str:
+    """Fetch OAuth token for oauth2_m2m (secret stored directly in record)."""
+    cache_key = f"{actor_id}:{conn['name']}"
+    cached = _token_cache.get(cache_key)
+    if cached and cached['expires_at'] > time.time() + 60:
+        return cached['token']
+
+    data = urllib.parse.urlencode({
+        'grant_type': 'client_credentials',
+        'client_id': conn['client_id'],
+        'client_secret': conn['client_secret'],
+        'scope': conn.get('scopes', conn.get('scope', '')),
+    }).encode()
+
+    req = urllib.request.Request(conn['token_url'], data=data,
+                                headers={'Content-Type': 'application/x-www-form-urlencoded'})
+    with urllib.request.urlopen(req, timeout=10) as resp:
+        body = json.loads(resp.read())
+
+    token = body['access_token']
+    expires_in = body.get('expires_in', 3600)
+    _token_cache[cache_key] = {'token': token, 'expires_at': time.time() + expires_in}
+    return token
+
+
 def _resolve_auth_headers(conn: dict, actor_id: str) -> dict:
     """Resolve auth headers for a connection."""
     auth_type = conn.get('auth_type', 'none')
     if auth_type == 'oauth_client_credentials':
         token = _get_oauth_token(conn, actor_id)
         return {'Authorization': f'Bearer {token}'}
+    elif auth_type == 'oauth2_m2m':
+        token = _get_m2m_token(conn, actor_id)
+        return {'Authorization': f'Bearer {token}'}
     elif auth_type == 'bearer':
         token = _get_ssm_value(conn['token_ssm'])
         return {'Authorization': f'Bearer {token}'}