IAV-848/feat(agent): add workflow template management, secondary credentials, and platform config refactor

Overview

This MR introduces several complementary improvements to the IAVIA Customer Care agent service:

• A new WorkflowTemplateService layer for uploading and validating N8N workflow templates per e-commerce platform (Shopify / WooCommerce)
• Secondary credential support for WhatsApp (primary WHATSAPP + secondary WHATSAPP_OAUTH trigger) in the wizard integration flow
• Richer integration response DTOs (WizardIntegrationResponse, CCSecondaryCredentialIntegrationResponse)
• Finalized N8nCredentialTypeMapping with OpenAI and platform-forbidden-credential guards
• WorkflowCredentialDTO as a clean internal DTO decoupling injection logic from external response types
• Minor fixes and hardening across configuration classes (ShopifyOAuthConfigs, MetaWebhookConfig, PlatformPermissionsConfig)
• Path constants cleanup and deduplication in AgentPaths

---

Changed Files

File	Change Type
configs/MetaWebhookConfig.java	Refactor — Instagram webhook config removed (moved or split)
configs/N8NProperties.java	Refactor — switched from @Configuration to @Component
configs/PlatformPermissionsConfig.java	Improvement — null-safe getRequiredPermissions() + getMissingPermissions()
configs/ShopifyOAuthConfigs.java	Fix — @NotBlank incorrectly applied to int fields
constants/paths/AgentPaths.java	Fix — duplicate class body removed
constants/AgentConstants.java	Stable — no functional change
services/WorkflowTemplateService.java	New — interface for template upload
services/implementations/WorkflowTemplateServiceImpl.java	New — validates + uploads platform-specific N8N workflow templates
services/helpers/N8nCredentialTypeMapping.java	Improvement — added OPENAI mapping + PLATFORM_FORBIDDEN_CREDENTIAL guard map
services/dtos/WorkflowCredentialDTO.java	New — minimal internal DTO for credential injection
dtos/.../WizardCreateIntegrationRequest.java	Improvement — added secondaryCredentials field
dtos/.../WizardIntegrationResponse.java	Improvement — added secondaryCredentials list in response
dtos/.../CCSecondaryCredentialRequestDTO.java	New — secondary credential request payload
dtos/.../CCSecondaryCredentialIntegrationResponse.java	New — secondary credential response payload

---

Key Design Decisions

WorkflowTemplateService Validation is run before upload (WorkflowTemplateValidator.validate()), ensuring no invalid JSON template ever reaches the file manager. Upload is dispatched via a switch on EcommercePlatformType, keeping the method exhaustive and compiler-checked.

Secondary Credentials (WhatsApp dual-credential model) WhatsApp requires two N8N credentials: whatsAppApi (action nodes) and whatsAppTriggerApi (trigger node). The wizard now accepts secondaryCredentials in its request and returns them in a typed list on the response, keeping the primary integration UID clean.

PLATFORM_FORBIDDEN_CREDENTIAL in N8nCredentialTypeMapping Prevents injecting a Shopify credential into a WooCommerce workflow and vice versa. Used by WorkflowCredentialInjector to skip nodes that belong to the competing platform.

---

Related Issues

IAV-848