refactor: move factcloud from hardcoded SSM to per-user DynamoDB oauth2_m2m connection

- Add oauth2_m2m auth type to mcp_loader.py (client_secret in record, not SSM)
- Remove _get_factcloud_token(), FACTCLOUD_* config, factcloud_clients from main.py
- Seed Daniel's factcloud connection into enrolled_services.mcp_connections
- factcloud now loaded dynamically via mcp_loader at session start

scripts/seed_factcloud.py

@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""Seed Daniel's factcloud MCP connection into DynamoDB."""
+import boto3
+
+ACTOR_ID = 'telegram:8537376738'
+TABLE_NAME = 'agent-claw-users'
+
+conn = {
+    'name': 'factcloud',
+    'url': 'https://factbase-cloud-gateway-2czetaoh3u.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp',
+    'auth_type': 'oauth2_m2m',
+    'client_id': '5fo2q4fb452j3aekd55g3190i4',
+    'client_secret': '1e0bqs8r4jk90sbeivh96mn893mgmv96h2olvcq7m3o5gjpjc56p',
+    'token_url': 'https://factbase-cloud.auth.us-east-1.amazoncognito.com/oauth2/token',
+    'scopes': 'factbase-cloud/read factbase-cloud/write',
+    'enabled': True,
+}
+
+session = boto3.Session(profile_name='ai1', region_name='us-east-1')
+ddb = session.resource('dynamodb')
+table = ddb.Table(TABLE_NAME)
+
+# Get existing connections, upsert factcloud
+resp = table.get_item(Key={'actor_id': ACTOR_ID})
+services = resp.get('Item', {}).get('enrolled_services', {})
+connections = services.get('mcp_connections', [])
+connections = [c for c in connections if c['name'] != 'factcloud']
+connections.append(conn)
+
+table.update_item(
+    Key={'actor_id': ACTOR_ID},
+    UpdateExpression='SET enrolled_services.mcp_connections = :conns',
+    ExpressionAttributeValues={':conns': connections},
+)
+print(f'Seeded factcloud connection for {ACTOR_ID}')