feat(adapters): add read-only Qonto business banking adapter (#1013)

[GallaGit]

Summary

Adds a read-only Qonto business banking adapter (fr/qonto.json), closes #1013 (October Challenge #997).

⚠️ Unverified against the live API. I don't have a Qonto sandbox account (Developer Portal), so every endpoint, parameter and the auth header are taken from docs.qonto.com and have not been exercised with real credentials. Please mark it as unverified, as suggested.

What's included

• packages/backend/src/adapters/fr/qonto.json: base URL https://thirdparty.qonto.com/v2, category banking, probe qonto_get_organization, API_KEY auth with Authorization: {{QONTO_LOGIN}}:{{QONTO_SECRET_KEY}} (no Bearer, no Base64), requiredEnvVars: ["QONTO_LOGIN","QONTO_SECRET_KEY"], docsUrl.
• 7 GET tools: qonto_get_organization (/organization), qonto_list_transactions (/transactions), qonto_get_transaction (/transactions/{id}), qonto_list_client_invoices (/client_invoices), qonto_list_supplier_invoices (/supplier_invoices), qonto_list_clients (/clients), qonto_list_quotes (/quotes). filter[...], status[] and operation_type[] are mapped in queryParams, as in clockodo/sellsy.
• instructions (~2,000 chars): how to get credentials, the auth format, a warning to assign the connector only to MCP servers whose users may see bank data, the workflow (organization → bank account id → transactions), pagination, and sandbox setup (https://thirdparty-sandbox.staging.qonto.co/v2 + X-Qonto-Staging-Token).
• fr/qonto.live.spec.ts: static checks (base URL, auth template contains : and has no Bearer/Basic, GET only, documented paths, probe, sandbox note). Live calls to /organization and /transactions run only with RUN_QONTO_LIVE=1 (+ QONTO_LOGIN, QONTO_SECRET_KEY, QONTO_STAGING_TOKEN, optional QONTO_BASE_URL).
• Logo packages/frontend/public/logos/connectors/qonto.svg (the wordmark Qonto serves on qonto.com).
• The optional content/guides/en/qonto-to-mcp.mdx guide is not included in this PR (can follow up).
• Regenerated catalog.ts; counts bumped 385 → 386 (adapter-count.mjs --check).

Pending maintainer checks (not verified, no account)

• Exact Authorization format: docs say Authorization: {sign-in}:{secret-key}, "no Base64 encoding". Not tested with a real call.
• Does /transactions refuse a call without bank_account_id or iban? Docs describe the list as "for the bank account identified by the bank_account_id / iban", but the OpenAPI excerpt does not mark either as required. The tool doesn't force either one; its description recommends passing one (from qonto_get_organization) and says a call without them is pending verification.

Checks run locally

• node scripts/validate-adapters.mjs --warn: clean, no qonto warnings
• node scripts/regenerate-catalog.mjs: done
• node scripts/adapter-count.mjs --check: OK (386 adapters)
• npx jest src/adapters/fr/qonto src/adapters/catalog src/adapters/mcp-adapter src/adapters/catalog-search: 6780 passed, 2 skipped (live)
• eslint on the spec: clean

Out of scope

Money movement (transfers, beneficiaries, cards), write endpoints, attachment upload, OAuth2.

Closes #1013

[helpcodeai]

Thanks @GallaGit, this is a clean one: the auth format matches the docs, it's GET only, the bank data warning is in the instructions, and you were upfront about not having an account. Two small things.

1. It conflicts with main now. Right now it's only package.json (the 0.29.0 release touched the line next to the description), but I'm merging a batch of new adapters today, so the counts in the READMEs, CITATION, glama.json, package.json and server.json will move again. Merge main after that and take whatever count main has plus one for Qonto.
2. Since it's not tested live, please add a short "Unverified." paragraph to the instructions like the other untested adapters have (see de/cas-genesisworld.json), saying the auth header and the account requirement on /transactions still need a real account to confirm. Optional while you're there: encodePathParams: true on qonto_get_transaction.

The red e2e check is the Google Fonts download on the runner, not your change, so don't worry about it. It'll run again after your merge.

[GallaGit]

Thanks @helpcodeai! I'll wait for today's adapter batch to land, then merge main tonight (taking main's count +1 for Qonto) and add the Unverified. paragraph plus encodePathParams: true on qonto_get_transaction. I'll start around 21:30 CEST and expect to push by ~22:00 CEST (20:00 UTC).

[helpcodeai]

Thanks @GallaGit, all in and right on time. CI is green and I hit the six routes on thirdparty.qonto.com with a dummy key. They all come back 401 "Invalid credentials" rather than 404, so the paths are right. Since nobody has run it against a real account yet, I pushed one small commit that keeps it out of the public catalog for now (unlisted, which also puts the counts back to 422). Self-hosters can still install it. We'll list it as soon as someone confirms the auth header with a real organization. Merging it today, thanks for a really clean first adapter.