PM-6363: Salesforce opportunity lookup and Salesforce-aligned SMU options

[jmgasper]

Implements the projects-api-v6 half of PM-6363.

What this adds

GET /v6/projects/salesforce/opportunities/:opportunityId — a read-only lookup returning the opportunity name, description, Subcontracting End Customer, Reporting SMU, Close Date, stage and a link to the record. The Work app uses it to populate project details from an opportunity; the Sales app uses it for the opportunity description popup.

{
  "id": "006UN00000XamntYAB",
  "name": "EMEA - Amazon Web Services - PS BFSI",
  "description": "Next AWS MVP/POC (Shabam Sponsor)",
  "customer": "Novartis Pharmaceuticals",
  "smu": "AMR1",
  "reportingSmu": "AMR1",
  "closeDate": "2026-07-31",
  "stageName": "Prospecting",
  "url": "https://topcoder.my.salesforce.com/006UN00000XamntYAB"
}

SalesforceClient is modelled on the reports-api-v6 Salesforce client, as requested:

• OAuth client-credentials flow, credentials and tokens stay in server memory.
• Trusted-origin allow-list (*.my.salesforce.com, login/test.salesforce.com) checked before credentials or tokens are sent anywhere.
• Bounded retries with backoff on network errors, 429 and 5xx; one session renewal on 401; sanitized errors only.
• Record ids are validated against ^006[a-zA-Z0-9]{12}([a-zA-Z0-9]{3})?$ before they reach the SOQL literal, so the id cannot terminate the quoted string.

Access requires a manager-tier role (Work app editors) or a talent-manager role (Sales app viewers).

SMU rename

The ticket asks to rename the SMU options "to follow the same naming pattern in all places". The dev Salesforce org emits APME, EURP, AMR1, AMR2 (and INTERNAL) for Opportunity.Reporting_SMU__c, so the options now use those exact codes and an imported opportunity maps onto a project with no translation. The ticket text lists "AMPE" and "AM2"; those are treated as typos of APME and AMR2, confirmed with the reporter.

Backward compatibility: projects saved as APMEA/Europe/Americas1/Americas2 are accepted and upgraded in place on the next write, so no data migration is needed and existing showcase saves keep working. An unrecognized Reporting SMU (for example INTERNAL) is surfaced as Others with the raw value in smuOther rather than being dropped.

Project.details.salesforceOpportunityId is validated alongside the other shared metadata.

Configuration

Four new optional env vars, documented in the README:

Variable	Default
SALESFORCE_API_CONSUMER_KEY	-
SALESFORCE_API_CONSUMER_SECRET	-
SALESFORCE_LOGIN_URL	https://topcoder.my.salesforce.com
SALESFORCE_REST_API_VERSION	65.0

These are separate from the existing JWT-bearer SALESFORCE_CLIENT_* variables used by BillingAccountService; both integrations coexist. Without them the endpoint returns 503 and nothing else changes.

Testing

• 32 new unit tests (client, service, controller, shared metadata utils). Full suite: 431 passed, same 15 pre-existing failures as origin/dev (JWT and metadata specs that need a database).
• Verified live against the dev Salesforce org with the provided credentials: an opportunity with a Subcontracting End Customer, one with Reporting_SMU__c = AMR1, one with INTERNAL (mapped to Others), and an unknown id (404).
• tsc --noEmit and eslint clean.

🤖 Generated with Claude Code