Add Aurea77 athlete-account plugin

[pedlima]

What this PR does

Adds the Aurea77 athlete-account plugin, version 1.0.0, as a local third-party package.

• Plugin name: aurea77
• Type: local (external_plugins)
• Vendored path: ./external_plugins/aurea77
• Homepage: https://aurea77.com
• Components: three canonical Aurea77 skills, one remote HTTP MCP declaration, existing brand icon, README, changelog and review cases.
• Catalog keywords/domains are limited to the Aurea77 brand.

Ownership and license

Submitted at the Aurea77 owner's request from their personal GitHub account, pedlima. The package retains the existing public-package author (MAIDOT) and Proprietary license designation. It does not include or relicense the Aurea77 backend source. Public service terms and privacy/support links are in the README.

Checklist

• Added exactly one unique kebab-case entry to .grok-plugin/marketplace.json.
• Regenerated .grok-plugin/plugin-index.json using the official generator.
• Official catalog validation passes locally.
• Official generated-index check passes locally.
• Local package includes README.md and .grok-plugin/plugin.json.
• Homepage, clear description, brand-scoped keywords/domains and license are stated.
• Reviewed the staged diff; only the Aurea77 package and its catalog/index entry change.
• Remote-source SHA pinning is not applicable to this vendored local source.

Security

• No executable hooks, local server, dependency install, remote-code download/exec or postinstall script.
• No embedded access/refresh tokens, client secret, API key, account data or reviewer credentials.
• No instructions to inspect or transmit local secrets, environment files or credentials.
• Account workflows preserve confirmation, pagination, API ownership/visibility checks, revisions and idempotency.

Network endpoints: https://api.aurea77.com/mcp/aurea77-grok, its protected-resource metadata and the existing Aurea77 authorization-server, authorize/token and connection-revocation endpoints documented in the README.

Credentials/permissions: each user needs their own Aurea77 athlete account and explicit OAuth consent. The server uses public clients, authorization code with S256 PKCE, exact callback/resource checks, rotating refresh and separate read/write scopes. Installing this package creates no user grant.

Validation

Executed locally with Python 3.13.5:

• scripts/validate-catalog.py: passed.
• scripts/generate-plugin-index.py: completed.
• scripts/generate-plugin-index.py --check: passed.
• git diff --cached --check: passed.
• Package inventory, JSON declarations, PNG inspection and the three skill bodies were verified. Only skill names differ from the canonical Aurea77 workflow source.
• Public website, support, privacy and terms pages were inspected without an authenticated Aurea77 session.

The production API (0.14.6) and three workflows have already been connected in Grok web. Expanded native tool records confirmed get_my_profile and list_my_events(page=1, per_page=1); the latter returned an empty result. No real account mutation was performed for that smoke test.

Draft merge gate: Grok Build OAuth

The successful reads above were in Grok web. They are not represented as Grok Build tests.

The current production Grok public client has the exact hosted callback https://grok.com/connectors-oauth-exchange-code/. Grok Build uses http://127.0.0.1:<port>/callback, requiring a separately compatible registration/configuration. Aurea77 currently supports preregistered public clients and does not offer DCR. This package intentionally contains no mismatched hosted client ID or permanent-token workaround.

Keep this submission in draft until the Build-specific OAuth flow and authenticated reads are verified. REVIEW.md provides five positive and three negative cases, explicitly marked not run in Build. Live writes, refresh-after-expiry and disconnect are not claimed as verified in Build. Existing Grok web access remains operational.