Google OAuth callback (sign-in or identity link)

Handles the redirect from Google. In sign-in mode, behaves like /oauth/github/callback: exchanges the code, fetches the Google sub/email/email_verified/hd claims, resolves or creates the account, and redirects to the frontend with a one-time auth code. A genuinely first sign-in whose email_verified claim is the literal true and whose address is gmail.com/googlemail.com, or matches a Google Workspace/Cloud hd claim case-insensitively, links onto whichever existing user already holds that address as a verified email identity, but only when that holder has no Google identity of their own (issue #392) — every other verified address still creates a new user, exactly as an unverified one does, and so does a holder who already has a DIFFERENT Google identity attached: that case creates a separate Google-only user rather than linking. Raw claims are never stored; only the narrowed, normalized address is, and only on the row it attaches to.

In identity-link mode (an oauth_google_link cookie set by a prior POST /oauth/google/link), redeems the ticket instead — every outcome, success or failure, redirects to {FRONTEND_URL}/settings?linked=google or {FRONTEND_URL}/settings?link_error=<code>, and SignInWithGoogle is never called. Every failure that happens before the ticket is redeemed (invalid state, a missing authorization code, or a Google token-exchange/userinfo failure) is normalized to the documented link-mode codes — link_invalid or internal_error — rather than leaking the raw sign-in error code.