Start linking a Google identity onto the signed-in user

Session-only (403 {"error":"session_required"} for an API key or an OAuth JWT). Mints a single-use ticket and returns the POST /oauth/google/link form target plus the raw ticket — the SPA submits these as a top-level form POST (never a redirect carrying the ticket in a query string: it is a live bearer credential for 10 minutes and must never appear in a URL or request log). The user then completes Google's consent screen, and the callback links the resulting identity onto this session's user.

Not mounted at all unless Google sign-in is configured — 404 otherwise (distinct from this handler's own 503, which covers the case where GET /api/v1/me and the email-link endpoints are mounted but Google specifically is not).