A15: complete the Google sign-in flow for an existing password-protected Sleipnir user.

Flow:

1. User clicks "Sign in with Google" on landing page.
2. Google OAuth callback finds an existing Sleipnir account with a real password (not the Google-only sentinel).
3. Callback creates a LoginPending(kind='oauth_link') row and redirects to /link-google?token=<pending_id> instead of issuing a session.
4. User on /link-google enters their Sleipnir password (and TOTP if 2FA is enabled).
5. /api/oauth/google/link-verify (this endpoint) verifies both factors, atomically deletes the pending row, creates a real session, sends a notification email.

Rate limits: DB-backed via rate_limiter module, per-IP and per-user_id (the latter only after pending lookup resolves).

Defense-in-depth: if pending.kind != 'oauth_link' (e.g., someone tries to use a 2FA pending_token here), reject. The endpoints have different attack surfaces and must not be interchangeable.