#762 Gmail connector (Highway app) + managed per-tenant OAuth + Vault-backed config

First real connector, end-to-end on demo. (1) ENGINE FIX: docker/highway-core/engine/config.py get_secret now falls back to Vault (hvac, VAULT_TOKEN_ADMIN, mount-prefixed KV v2) after env/ini — the deployed engine had vault_client=None so the secret-manager was disconnected and per-tenant secrets impossible. env/ini still win; no regression. (2) Gmail app enterprise/apps/pre_installed/gmail.py (send/search/get; refresh via urllib, Gmail API via ctx.http_request; per-tenant tokens via secrets). (3) OAuth api/oauth_handlers/gmail.py authorize/callback/disconnect: consent URL (signed state carries tenant) -> callback exchanges code, stores tokens in Vault tenants/{t}/gmail, upserts the gmail install with per-tenant secrets_config. callback RBAC-exempt. (4) agent_catalog gmail_send/search/get -> apps.platform.gmail.*; MCP connect_gmail/disconnect_gmail. VALIDATED: consent (farsheed.ashouri@gmail.com) -> tokens in Vault -> agent picked gmail_send (HITL) -> app refreshed token from Vault -> Gmail messages/send 200 -> real email delivered. Follow-ups: callback used dict-row indexing + installed_by (fixed); Phase B triggers (watch via Pub/Sub); Google restricted-scope verification before public launch.