investigate: Context7 and Ref OAuth connector billing, then document the cloud connectors route (slices 51, 52)

The docs change goes in docs/cloud-sessions.md (the miro and dometrain-mcp plugin text near lines 414-417) and docs/cloud-fleet-setup.md. Check .claude/cloud-bootstrap.sh for any mcp add lines, and confirm no .mcp.json exists. The connector billing probe is user-run on an external account, so an agent cannot finish it. Done means the Phase 8 sanity greps pass and markdownlint is clean, after the probe results are recorded.

Why

The 2,000-PRs talk Brief (Q103) routes documentation and search MCP servers (Context7, Ref, Firecrawl, Perplexity) to cloud sessions as OAuth claude.ai connectors added once per account, instead of a repository MCP route. Whether each vendor's OAuth connector bills the user's plan or a free tier is unverified, and that decides whether the route is usable. Slices 51 (billing probe) and the connector half of 52 (cloud docs) were planned in the integration branch's WS-H plan, Phases 7 and 8, and deferred out of the integration PR. The other half of slice 52, replacing the "There is no secrets store" claim in docs/cloud-fleet-setup.md and docs/cloud-sessions.md with the API-credentials fact, lands in the integration PR and is not part of this issue.

What

1. Slice 51 (HITL, user-run on an external account; agents run nothing there): add Context7 and Ref as connectors, make one call each from a cloud session, record which pool was debited, and check whether the Add custom connector dialog has a Request headers section.
2. Connector half of slice 52 (blocked by 1): document the connectors route in docs/cloud-sessions.md and docs/cloud-fleet-setup.md, and say how the miro and dometrain-mcp plugin servers behave in cloud sessions. The repository adds no MCP route.

Deferred plan text

Copied from the integration branch's local plan (WS-H.md Phases 7 and 8; Phase 8 with its secrets-store bullet and sanity lines removed), which is not in the repository. <S> was the local work folder. "record connectors ..." and "X1" refer to local research records; recheck the cited vendor facts against current docs before relying on them. Line numbers are as of the plan date and may have moved.

### Phase 7: connector billing check on the user's account (slice 51) [TODO]

Q103; H10. HITL: the user does every step on an external account; agents run nothing there.

- [ ] The user adds Context7 as a claude.ai custom connector at `https://mcp.context7.com/mcp/oauth`
      (plain `/mcp` answered anonymously, record connectors V-1), notes the context7.com dashboard usage,
      makes one call from a cloud session, and re-reads it.
- [ ] The user adds Ref with OAuth, adding `?scope=<team_id>` when the account is in more than one Ref
      team (record connectors R-1; billing by scope is a gap), makes one call, and checks which pool was
      debited.
- [ ] The user looks for a Request headers section in the Add custom connector dialog (connectors
      Conflict 3; it decides whether Dometrain, header key only per record connectors V-5, can be a
      connector).
- [ ] The coordinator writes `<S>/probes/connector-billing.md` from the user's reply: `context7:` and
      `ref:` lines (`billed-to-plan`, `free-tier` or `unclear`, with the account or team and the date),
      and `request-headers: yes` or `request-headers: no`. If either vendor does not bill the plan, the
      user chooses between free-tier limits and reopening Q103 before Phase 8 [FALLBACK].

**Sanity Check:** `grep -cE '^(context7|ref): (billed-to-plan|free-tier|unclear)' <S>/probes/connector-billing.md` prints `2`;
`grep -cE '^request-headers: (yes|no)$' <S>/probes/connector-billing.md` prints `1`.

### Phase 8: connectors route in the cloud docs (slice 52) [TODO]

Q103; H10. HITL (the user adds connectors on each account). Blocked by Phase 7 and Phase 5 (same
`docs/cloud-sessions.md`).

- [ ] `docs/cloud-sessions.md` and `docs/cloud-fleet-setup.md`: the Q103 connectors (Context7 at
      `/mcp/oauth`, Ref, Firecrawl, Perplexity) are OAuth claude.ai connectors added once per account; the
      cloud host passes account connectors into every cloud session, Miro included, filtered only by
      organization allow and deny lists and a host `managed-mcp.json` (record connectors CC-1); a routine
      includes every connected connector by default, its tools run without approval, and each routine
      removes the ones it does not need (record connectors CC-2; routines are a research preview);
      untrusted-input stages run on a cloud host only with no connector tools present (X1); Perplexity's
      OAuth bills the API organization's credits, not a consumer plan (record connectors P-2); no lane
      stage calls Miro or Dometrain, and Dometrain is not routed to cloud unless Phase 7 found request
      headers; the repository adds no MCP route (no `.mcp.json`, no bootstrap registration).
- [ ] `docs/cloud-sessions.md:414-417` (the `miro` and `dometrain-mcp` plugin servers needing `userConfig`
      credentials): say that in cloud sessions Miro reaches the session as the account connector, not the
      `miro` plugin's server, and that `dometrain-mcp` stays off.
- [ ] Commit `docs(cloud): connectors route`.

**Sanity Check:** after the coordinator merge,
`grep -c '/mcp/oauth' docs/cloud-sessions.md` is at least `1`;
`grep -ci 'API organization' docs/cloud-sessions.md` is at least `1`;
`awk -v RS= '/miro_api_token/ && /connector/' docs/cloud-sessions.md | grep -c 'miro_api_token'` is at least `1` (paragraph match, the text is hard-wrapped);
`awk -v RS= '/dometrain-mcp/' docs/cloud-sessions.md | grep -ci 'off'` is at least `1` (dometrain-mcp stays pinned off);
`test ! -f .mcp.json` exits 0;
`git diff origin/main -- .claude/cloud-bootstrap.sh | grep -c 'mcp add'` prints `0`;
`npx markdownlint-cli2 docs/cloud-sessions.md docs/cloud-fleet-setup.md` exits 0;
`git -C <worktree> merge-base --is-ancestor slice/52-connectors-route HEAD` exits 0.

Acceptance

• A recorded probe result with context7: and ref: lines (billed-to-plan, free-tier or unclear, with account or team and date) and a request-headers: yes|no line.
• If either vendor does not bill the plan, the user has chosen between free-tier limits and reopening Q103 before the docs change.
• The docs change passes the Phase 8 sanity checks above, adds no .mcp.json and no mcp add in .claude/cloud-bootstrap.sh.

Refs: #6085