#40728 chore: migrate batch4 client DDP callers + add 6 REST endpoints

Summary

Continues the DDP→REST sweep started in #40659, #40711, #40675, #40724. This batch tackles the next set of client DDP callers whose endpoints didn't exist yet. The DDP methods stay registered for external SDK/mobile clients and each gets a methodDeprecationLogger.method(NAME, '9.0.0', '/v1/...') line pointing at the new REST route.

New endpoints

DDP method	REST endpoint	Notes
verifyEmail + afterVerifyEmail	POST /v1/users.verifyEmail	Single call: marks email verified + anonymous→user role swap
cloud:connectWorkspace	POST /v1/cloud.connectWorkspace	manage-cloud perm
authorization:addPermissionToRole	POST /v1/permissions.addRole	per-permission perm check reused
authorization:removeRoleFromPermission	POST /v1/permissions.removeRole	per-permission perm check reused
clearIntegrationHistory	POST /v1/integrations.history.clear	manage-(own-)outgoing-integrations
replayOutgoingIntegration	POST /v1/integrations.outgoing.replay	manage-(own-)outgoing-integrations

Endpoint extensions

• POST /v1/users.setAvatar now accepts an optional service multipart field (stored as avatarOrigin), replacing setAvatarFromService DDP method.

Server-side hook

• afterLogoutCleanUpCallback + Apps.IPostUserLoggedOut move into a Accounts.onLogout handler + /v1/users.logout post-token-unset block. Client sdk.call('logoutCleanUp') dropped — both DDP and REST logout paths now fire the callbacks server-side.

Reverted from this batch

• getRoomByTypeAndName — per review feedback, kept as DDP. It may be replaced by a breaking change (e.g. URL routing moving directly to rid) so the migration is deferred.

Known follow-ups

• Per-user 2FA TOTP (#40734, draft), OAuth admin services, audit EE, search providers, webdav, presence — still need new endpoints; will be split into smaller domain PRs.
• resetPassword (web-ui-registration) + checkRegistrationSecretURL + anonymous registerUser flow remain.

Test plan

• CI green (lint + typecheck pass with rebuilt rest-typings dist)
• Admin → Users → upload avatar with OAuth provider service → avatarOrigin matches the service name
• Workspace registration → connect with offline token → success
• Verify email link → role swaps anonymous→user
• Admin → Permissions table → grant/revoke a role to a permission
• Admin → Integrations → clear history + replay an outgoing webhook entry
• Log out (DDP) → afterLogoutCleanUpCallback server logs fire
• Log out via POST /v1/users.logout → same callbacks fire

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added authenticated REST endpoints for cloud workspace connection, integration history clearing/replay, permission role add/remove, and email verification.
  • Avatar uploads now optionally preserve the original service source.
• Bug Fixes
  • Logout cleanup and post-email verification now execute server-side reliably for both REST and DDP flows.
  • Replay/clear and permission role actions now follow the newer REST request/response paths.
• Chores
  • Legacy DDP actions remain available, with deprecation notices pointing to the new REST endpoints.

Task: ARCH-2267