Google sign-in callback

Where Google returns the browser. Always redirects back to the dashboard, carrying ?google=<outcome> when the attempt did not end in a session — notably email_taken, which is returned rather than claiming an existing account: email is not verified at signup, so a matching address is not proof of ownership. Link Google from an authenticated session instead. When the account has a second factor the redirect carries ?mfa=<challenge> and no session is issued yet.