[Feat] Add authoritative Rippling people context to Brain

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote or in the web UI.

What changed

• Adds Rippling as a deployment-scoped, admin-configured HRIS integration whose API token stays encrypted on the control plane and is validated before persistence.
• Collects Rippling V2 workers through origin-restricted cursor pagination with bounded network, server-error, and rate-limit retries. Relationship expansions are applied to both the initial request and cursor-only continuation links.
• Projects roster records into Brain person and person-alias pages with source provenance, snapshot freshness, employment fields, canonical email matching, authoritative reporting lines, and department/team memberships.
• Uses resumable complete snapshots and post-snapshot inventory reconciliation so interrupted scans cannot deactivate employees; terminated, missing, and disconnected workers retain explicit inactive or unavailable lifecycle state.
• Documents API-token permissions, privacy implications, snapshot behavior, and the separately entitled Worker Changes API, with focused API, collector, Settings UI, and self-setup catalog coverage.

Why this change was made

Brain previously connected people through Roomote and collaboration-system identities but had no authoritative HRIS source. Rippling now supplies explicit roster, employment, reporting, and membership truth without conflating it with inferred collaboration signals.

Impact

Deployment admins can connect one company-wide Rippling V2 API token from Settings > Integrations. Brain then keeps the employee directory and org structure current while preserving exact Rippling status, provenance, and observation timestamps across every roster page.

Live upstream verification still requires a Rippling account with the API product, company-wide permissions, and the documented read scopes; no Rippling credential was available in the development environment. Focused collector, integration UI, and self-setup tests pass, as do lint, repository-wide fast type checks, Knip, and pre-push checks. The initial Docker and upgrade CI failures occurred while GitHub returned 429 responses downloading pinned actions, before repository code ran; the updated push reruns them. Settings screenshots could not be captured because the local preview remained behind the deployment setup gate.

[roomote-community]

No code issues found in this update. See task

• Preserve Rippling relationship expansions when following cursor-only next_link URLs (apps/bullmq/src/scheduled-jobs/brain-collectors.ts:2630).

_{Reviewed aa05307}

[roomote-roomote]

Fixed the Rippling continuation expansion issue in aa05307b: cursor-only next_link requests now retain all relationship expansions, with regression coverage. Also added the missing Rippling self-setup metadata and Settings test mocks/coverage that caused the Test check failure. The review thread is resolved, automated re-review found no code issues, the draft PR metadata is refreshed, and all rerun checks pass, including Test, Docker Build, and Upgrade Compatibility. See task