feat: wire Tufts SCO to DentaQuest portal and fix insurance credential dropdown

- Add /dentaquest-eligibility endpoint in Python agent (Tufts SCO uses providers.dentaquest.com)
- Add backend route, processor, and service client for Tufts SCO (separate from UnitedSCO/DentalHub)
- Fix Tufts SCO button to post to new tuftssco route instead of unitedsco
- Fix credential field names: dentaquestUsername/Password (was tuftsscoUsername/Password)
- Fix socket event: listen for selenium:dentaquest_session_started (was unitedsco)
- Fix error visibility: keep session alive 30s on error so backend reads real message
- Replace free-text Site Key field with dropdown to prevent key mismatches

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/Backend/src/services/seleniumDentaQuestEligibilityClient.ts

@@ -0,0 +1,72 @@
+import axios from "axios";
+import http from "http";
+import https from "https";
+import dotenv from "dotenv";
+dotenv.config();
+
+const SELENIUM_AGENT_BASE = process.env.SELENIUM_AGENT_BASE_URL;
+
+const httpAgent = new http.Agent({ keepAlive: true, keepAliveMsecs: 60_000 });
+const httpsAgent = new https.Agent({ keepAlive: true, keepAliveMsecs: 60_000 });
+
+const client = axios.create({
+  baseURL: SELENIUM_AGENT_BASE,
+  timeout: 5 * 60 * 1000,
+  httpAgent,
+  httpsAgent,
+  validateStatus: (s) => s >= 200 && s < 600,
+});
+
+async function requestWithRetries(config: any, retries = 4, baseBackoffMs = 300) {
+  for (let attempt = 1; attempt <= retries; attempt++) {
+    try {
+      const r = await client.request(config);
+      if (![502, 503, 504].includes(r.status)) return r;
+      console.warn(`[dentaquest-client] retryable HTTP status ${r.status} (attempt ${attempt})`);
+    } catch (err: any) {
+      const code = err?.code;
+      const isTransient =
+        code === "ECONNRESET" || code === "ECONNREFUSED" || code === "EPIPE" || code === "ETIMEDOUT";
+      if (!isTransient) throw err;
+      console.warn(`[dentaquest-client] transient network error ${code} (attempt ${attempt})`);
+    }
+    await new Promise((r) => setTimeout(r, baseBackoffMs * attempt));
+  }
+  return client.request(config);
+}
+
+function log(tag: string, msg: string, ctx?: any) {
+  console.log(`${new Date().toISOString()} [${tag}] ${msg}`, ctx ?? "");
+}
+
+export async function forwardToSeleniumDentaQuestEligibilityAgent(data: any): Promise<any> {
+  const payload = { data };
+  const url = `/dentaquest-eligibility`;
+  log("dentaquest-client", "POST dentaquest-eligibility", { url: SELENIUM_AGENT_BASE + url });
+  const r = await requestWithRetries({ url, method: "POST", data: payload }, 4);
+  log("dentaquest-client", "agent response", { status: r.status, dataKeys: r.data ? Object.keys(r.data) : null });
+  if (r.status >= 500) throw new Error(`Selenium agent server error: ${r.status}`);
+  return r.data;
+}
+
+export async function forwardOtpToSeleniumDentaQuestAgent(sessionId: string, otp: string): Promise<any> {
+  const url = `/submit-otp`;
+  log("dentaquest-client", "POST submit-otp", { url: SELENIUM_AGENT_BASE + url, sessionId });
+  const r = await requestWithRetries({ url, method: "POST", data: { session_id: sessionId, otp } }, 4);
+  log("dentaquest-client", "submit-otp response", { status: r.status, data: r.data });
+  if (r.status >= 500) throw new Error(`Selenium agent server error on submit-otp: ${r.status}`);
+  return r.data;
+}
+
+export async function getSeleniumDentaQuestSessionStatus(sessionId: string): Promise<any> {
+  const url = `/session/${sessionId}/status`;
+  log("dentaquest-client", "GET session status", { url: SELENIUM_AGENT_BASE + url, sessionId });
+  const r = await requestWithRetries({ url, method: "GET" }, 4);
+  log("dentaquest-client", "session status response", { status: r.status, dataKeys: r.data ? Object.keys(r.data) : null });
+  if (r.status === 404) {
+    const e: any = new Error("not_found");
+    e.response = { status: 404, data: r.data };
+    throw e;
+  }
+  return r.data;
+}