feat: WeKan ticketing source

- wekan connector: board id as project key, cards assigned to the
  consultant's WeKan username (assignees with member fallback), archived
  cards skipped, client-side modifiedAt since-filtering, username/password
  login with token reuse (or pre-issued token), case-insensitive identity
- fake-WeKan unit tests: factory validation, test-connection, fetch
  filtering, key listing, token reuse
- admin customer wizard: WeKan option + credential fields
- OpenAPI enum + credential shapes, README identity mapping docs

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

DECISIONS.md

@@ -137,3 +137,16 @@ Spec-silent choices, recorded as required by the build instructions.
 - **`scripts/acceptance.sh`** automates the §13 checklist live (import →
   subdivide → extend → publish → claim/decline/approve → review → award →
   AI job via real Claude Code → breaker independence) and is re-run-safe.
+
+## Post-deploy additions
+
+- **WeKan connector**: `projectKey` is the board id; "assigned to the
+  consultant" means the consultant's WeKan username (from
+  `ticketingIdentities.wekan`) appears in a card's `assignees` (falling back
+  to `members` when no assignee is set). Archived cards are skipped. WeKan
+  has no epic/story hierarchy → all cards map to type `task`; the API offers
+  no server-side updated-since filter, so the connector filters on
+  `modifiedAt` client-side (one details request per card — fine for board
+  sizes WeKan handles). Auth: username+password login per sync with a 10-min
+  token reuse window, or a pre-issued token. Card attachments are not
+  imported in v1.