Init Oauth

Start the OAuth flow — redirect to Google's authorization screen.

Generates a single-use state token (uuid4 hex), stores {admin_id, env} in Redis under vendors_oauth_state:{state} with a 10-minute TTL, then 302s to Google. The callback verifies + deletes the state token on consumption.

access_type=offline and prompt=consent are BOTH required so Google always returns a refresh token (without prompt=consent, repeat consents skip issuing one).