docs: spec for SaaS integration & inbound request trust feature

/speckit-specify output for 002-saas-integration (roadmap Phase 2):
3 user stories (authenticate/validate inbound requests, admin
onboarding/rotation/revocation, rate limiting) and 12 functional
requirements. Reserves an idempotency-key field on the inbound
contract for the future ticketing feature (docs/11 gap A1) without
implementing dedup here. Quality checklist passes with no
NEEDS CLARIFICATION markers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

specs/002-saas-integration/checklists/requirements.md

@@ -0,0 +1,40 @@
+# Specification Quality Checklist: SaaS Product Integration & Inbound Request Trust
+
+**Purpose**: Validate specification completeness and quality before proceeding to planning
+**Created**: 2026-08-21
+**Feature**: [spec.md](../spec.md)
+
+## Content Quality
+
+- [x] No implementation details (languages, frameworks, APIs)
+- [x] Focused on user value and business needs
+- [x] Written for non-technical stakeholders
+- [x] All mandatory sections completed
+
+## Requirement Completeness
+
+- [x] No [NEEDS CLARIFICATION] markers remain
+- [x] Requirements are testable and unambiguous
+- [x] Success criteria are measurable
+- [x] Success criteria are technology-agnostic (no implementation details)
+- [x] All acceptance scenarios are defined
+- [x] Edge cases are identified
+- [x] Scope is clearly bounded
+- [x] Dependencies and assumptions identified
+
+## Feature Readiness
+
+- [x] All functional requirements have clear acceptance criteria
+- [x] User scenarios cover primary flows
+- [x] Feature meets measurable outcomes defined in Success Criteria
+- [x] No implementation details leak into specification
+
+## Notes
+
+- Auth mechanism choice (signed tokens/OAuth2/mTLS) and rotation-window length are deliberately
+  left to `/speckit-plan`, not decided here — see spec.md Assumptions.
+- Idempotency-key enforcement is explicitly deferred to the future ticketing feature (FR-012
+  reserves the field only); this is a scope boundary, not a gap.
+- Exact rate-limit values and auth-mechanism-per-integration defaults are
+  `REQUIRES BUSINESS CONFIRMATION` per docs/10-implementation-roadmap.md — not invented here.
+- All items pass; no revision iterations were needed.