feat(napta): client-credentials auth + real project listing

Napta uses Auth0 M2M, not a static token: exchange client_id/secret for a cached
JWT, then list non-archived projects via JSON:API (include client name). Falls back
to fixtures when NAPTA_CLIENT_ID/SECRET are unset. Member resolution still stubbed.

backend/src/config.ts

@@ -1,19 +1,29 @@
 export interface Config {
   port: number
-  naptaApiToken: string | null
+  // Napta uses Auth0 Machine-to-Machine (client-credentials), not a static token:
+  // client_id + client_secret are exchanged for a short-lived JWT (see napta.ts).
+  naptaClientId: string | null
+  naptaClientSecret: string | null
   naptaBaseUrl: string
+  naptaAuthUrl: string
+  naptaAudience: string
   slackBotToken: string | null
 }
 
 export const config: Config = {
   port: Number(process.env.PORT ?? 8000),
-  naptaApiToken: process.env.NAPTA_API_TOKEN || null,
+  naptaClientId: process.env.NAPTA_CLIENT_ID || null,
+  naptaClientSecret: process.env.NAPTA_CLIENT_SECRET || null,
   naptaBaseUrl: process.env.NAPTA_BASE_URL || "https://app.napta.io/api/v1",
+  naptaAuthUrl: process.env.NAPTA_AUTH_URL || "https://auth.napta.io/oauth/token",
+  naptaAudience: process.env.NAPTA_AUDIENCE || "backend",
   slackBotToken: process.env.SLACK_BOT_TOKEN || null,
 }
 
-// Live data needs BOTH a Napta token (to list projects/people) and a Slack
-// token (to resolve avatars). Without both, the API serves demo fixtures.
-export const hasLiveCredentials: boolean = Boolean(
-  config.naptaApiToken && config.slackBotToken,
+// Listing Projects and Members needs Napta. Without it, the API serves fixtures.
+export const hasNaptaCredentials: boolean = Boolean(
+  config.naptaClientId && config.naptaClientSecret,
 )
+
+// Slack only resolves Avatars; it's optional and degrades to initials when absent.
+export const hasSlackCredentials: boolean = Boolean(config.slackBotToken)