fix(credentials): Group B verification round — transient statuses, current Salesforce setup flow, rotation-correct mint cache

- 408/429 from token endpoints map to provider_unavailable in all three
  minters (throttling never blames the customer's credentials)
- Salesforce docs lead with the External Client App flow (classic Connected
  App creation is disabled by default since Spring '26)
- Mint cache validates a ciphertext fingerprint on every hit (rotation-
  correct across instances), evicts deleted credentials, memoizes failures
  for 30s, and skips identity lookups on execution-time mints
- Salesforce DNS failures on the My Domain host map to site_not_found
- Pipedrive pipeline-deals migrated off the sunset v1 endpoint to /api/v2
- Zoom granted scopes persisted for scope-gap debugging; docs claims
  softened to match rendered UI errors; Box Enterprise ID steps per Box's
  Locating Common Values doc

Author: waleedlatif1

apps/docs/content/docs/en/integrations/box-service-account.mdx

@@ -7,7 +7,7 @@ import { Callout } from 'fumadocs-ui/components/callout'
 import { Step, Steps } from 'fumadocs-ui/components/steps'
 import { FAQ } from '@/components/ui/faq'
 
-Box Platform apps with **Server Authentication (Client Credentials Grant)** let your workflows authenticate to Box as the app's own **Service Account** instead of through a person's OAuth login. You create the app once, a Box admin authorizes it for the enterprise, and Sim mints short-lived access tokens from the app's credentials on demand — no user consent to expire, and access that's controlled entirely by which folders the Service Account is invited into.
+Box Platform apps with **Server Authentication (with Client Credentials Grant)** let your workflows authenticate to Box as the app's own **Service Account** instead of through a person's OAuth login. You create the app once, a Box admin authorizes it for the enterprise, and Sim mints short-lived access tokens from the app's credentials on demand — no user consent to expire, and access that's controlled entirely by which folders the Service Account is invited into.
 
 This is the recommended way to use Box in production workflows: nothing depends on a user staying logged in, the app's scopes are explicit, and the Service Account's reach is auditable folder by folder.
 
@@ -21,9 +21,9 @@ Anyone with Developer Console access can create the app, but a Box **admin or co
 
 <Steps>
   <Step>
-    Go to the [Box Developer Console](https://app.box.com/developers/console), open **My Apps**, click **Create Platform App**, and choose **Server Authentication (Client Credentials Grant)**
+    Go to the [Box Developer Console](https://app.box.com/developers/console), open **My Apps**, click **Create Platform App**, and choose **Server Authentication (with Client Credentials Grant)**
 
-    {/* TODO(screenshot): Box Developer Console Create Platform App dialog with Server Authentication (Client Credentials Grant) selected */}
+    {/* TODO(screenshot): Box Developer Console Create Platform App dialog with Server Authentication (with Client Credentials Grant) selected */}
   </Step>
   <Step>
     On the **Configuration** tab, set the **App Access Level**. **App Access Only** (the default) is sufficient — choose **App + Enterprise Access** only if the Service Account should also reach existing managed users' content via admin APIs
@@ -39,7 +39,7 @@ Anyone with Developer Console access can create the app, but a Box **admin or co
     {/* TODO(screenshot): OAuth 2.0 Credentials panel showing the Client ID and the client secret reveal */}
   </Step>
   <Step>
-    Copy the **Enterprise ID** — a numeric value shown on the app's **General Settings** tab, or in **Admin Console** → **Account & Billing** → **Account Information**
+    Copy the **Enterprise ID** — a numeric value. In the Developer Console, click your account icon in the top right and choose **Copy Enterprise ID**; a Box admin can also find it in **Admin Console** → **Account & Billing** → **Account Information**
   </Step>
 </Steps>
 
@@ -66,7 +66,7 @@ Alternatively, the developer can click **Review and Submit** on the app's **Auth
 
 ### 3. Give the Service Account Access to Folders
 
-The Service Account is a brand-new Box user — its email looks like `AutomationUser_AppServiceID_RandomString@boxdevedition.com` and is shown on the app's **General** tab. Its folder tree starts **empty**: a fully valid credential sees zero items and gets `404`s on real files and folders until you grant it access.
+The Service Account is a brand-new Box user — its email looks like `AutomationUser_AppServiceID_RandomString@boxdevedition.com` and is shown on the app's **General Settings** tab. Its folder tree starts **empty**: a fully valid credential sees zero items and gets `404`s on real files and folders until you grant it access.
 
 <Steps>
   <Step>
@@ -87,10 +87,10 @@ Community reports indicate the Service Account can't be collaborated into a user
 
 <Steps>
   <Step>
-    Open your workspace **Settings** and go to the **Integrations** tab
+    Open **Integrations** from your workspace sidebar
   </Step>
   <Step>
-    Search for "Box" and click it, then click **Add to Sim** and choose **Add service account**
+    Search for "Box" and open it, then click **Add to Sim** and choose **Add service account**
 
     {/* TODO(screenshot): Box integration page with the Add service account connect option */}
   </Step>
@@ -100,7 +100,7 @@ Community reports indicate the Service Account can't be collaborated into a user
     {/* TODO(screenshot): Add Box service account dialog with all three fields filled in */}
   </Step>
   <Step>
-    Click **Add service account**. Sim verifies the credentials by minting a real access token from Box — if it fails, you'll see a specific error explaining what went wrong (bad credentials, an app the admin hasn't authorized yet, or values that don't all belong to the same app and enterprise).
+    Click **Add service account**. Sim verifies the credentials by minting a real access token from Box — if it fails, the error tells you whether Box rejected the credentials or couldn't be reached. A rejection usually means bad credentials, an app the admin hasn't authorized yet, or values that don't all belong to the same app and enterprise.
   </Step>
 </Steps>
 
@@ -122,10 +122,10 @@ Access tokens minted from the app are short-lived (typically one hour) and there
 
 <FAQ items={[
   { question: "Why a Service Account instead of OAuth?", answer: "The Service Account is its own Box user, owned by the app — nothing expires when someone leaves or their login lapses. Access is granted folder by folder through collaborations, which makes the credential's reach explicit and auditable." },
-  { question: "The credential validates but every block returns nothing or 404s — why?", answer: "The Service Account's folder tree starts empty. It only sees folders it has been invited into as a collaborator. Invite its @boxdevedition.com email (shown on the app's General tab) as an Editor on the folders your workflows use." },
+  { question: "The credential validates but every block returns nothing or 404s — why?", answer: "The Service Account's folder tree starts empty. It only sees folders it has been invited into as a collaborator. Invite its @boxdevedition.com email (shown on the app's General Settings tab) as an Editor on the folders your workflows use." },
   { question: "Adding the credential fails with 'This app is not authorized by the enterprise admin' — what now?", answer: "A Box admin or co-admin must authorize the app in Admin Console → Apps → Platform Apps Manager (or Platform → Platform Apps in some tenants) by adding its Client ID. Until then, all token requests fail." },
   { question: "I added a scope but tools still fail with 403 — why?", answer: "Authorization is a snapshot of the app's scopes at the time the admin approved it. After any scope or access-level change, the admin must re-authorize the app in Platform Apps Manager before the new scopes apply." },
-  { question: "It says 'The grant type is unauthorized for this client_id' — why?", answer: "The app was created with user authentication (OAuth 2.0) instead of Server Authentication. Create a new Platform App and choose Server Authentication (Client Credentials Grant)." },
-  { question: "It says 'Grant credentials are invalid' — why?", answer: "The Client ID, Client secret, and Enterprise ID don't all belong to the same Box app and enterprise — most often a mismatched ID/secret pair. Re-copy all three values from the same app in the Developer Console." },
+  { question: "It says 'The grant type is unauthorized for this client_id' — why?", answer: "The app was created with user authentication (OAuth 2.0) instead of Server Authentication. Create a new Platform App and choose Server Authentication (with Client Credentials Grant)." },
+  { question: "It says 'Grant credentials are invalid' — why?", answer: "Either the Client ID, Client secret, and Enterprise ID don't all belong to the same Box app and enterprise (most often a mismatched ID/secret pair), or the app hasn't been authorized in the Admin Console yet. Re-copy all three values from the same app in the Developer Console, and make sure an admin has authorized the app in Platform Apps Manager." },
   { question: "Do Box Sign operations work with a service account?", answer: "Yes, if the app has the Manage signature requests scope, the admin has (re-)authorized the app since it was added, and Box Sign is enabled on your enterprise plan. File and folder operations work regardless." },
 ]} />

apps/docs/content/docs/en/integrations/pipedrive-service-account.mdx

@@ -38,10 +38,10 @@ The API token grants everything its user can see and do in Pipedrive. Treat it l
 
 <Steps>
   <Step>
-    Open your workspace **Settings** and go to the **Integrations** tab
+    Open **Integrations** from your workspace sidebar
   </Step>
   <Step>
-    Search for "Pipedrive Service Account" and click it, then click **Add to Sim** and choose **Add API token**
+    Search for "Pipedrive" and open it, then click **Add to Sim** and choose **Add API token**
   </Step>
   <Step>
     Paste the **API token**, and optionally set a display name and description