Add Slack MCP module with enforced read-only mode

[tpetr]

Add a reusable slack-mcp Coder module that installs a stdio adapter for Slack's official MCP endpoint using the workspace owner's external-auth token. Read-only is the default; access_mode = "read-write" explicitly enables all tools allowed by the user's Slack grant.

Read-only uses an explicit allowlist of 12 reviewed search/read tools. It filters tool discovery and rejects every non-allowlisted tools/call before acquiring credentials or forwarding the call. This covers direct/stale calls to send, schedule, and draft messages, plus unknown future tools regardless of their read-only hints. Paginated discovery traverses write-only pages to find later read tools. The policy constrains calls through the adapter, not the underlying OAuth grant or direct API use.

Retain the established optional-auth lifecycle: a healthy empty MCP when unlinked, Coder linking-URL guidance, tool-list change notifications after linking/unlinking, and per-request credential acquisition for refresh. Install Node 24 and the pinned official SDK with the frozen dependency graph and disabled lifecycle scripts. Export the launcher command for caller-owned client registration; document Codex environment forwarding.

Validation:

• 16 adapter tests and six Terraform mock-provider tests pass; formatting and validation pass.
• Fresh and repeat installation pass in a temporary directory.
• Live discovery exposes 12 tools in read-only and 15 in read-write for the connected account.
• A direct send-message call in read-only is rejected locally with zero upstream tool calls. The live smoke test additionally prohibits all upstream tool calls, so no message was posted.
• CI runs adapter and Terraform tests.

Publication review: staged files contain generic module code, public dependency metadata, and fake test credentials. No access tokens, private workspace data, or internal deployment values are included.

[ajbt200128]

beep boop approved