Start a Google identity link

The sole entry point for starting an identity link (issue #316 fold finding 53dbd2c17572ecf3). The SPA submits, as a top-level form POST (never a GET query string, so the bearer ticket never appears in the request-URI-keyed request logger), the link_ticket returned by POST /api/v1/me/identities/google.

Validates the ticket read-only (no redemption yet — that happens at /oauth/google/callback). A malformed, wrong-length, unknown, expired, or already-consumed ticket clears any stale oauth_google_link cookie and redirects straight to {FRONTEND_URL}/settings?link_error=link_invalid without contacting Google. A valid ticket sets an oauth_google_link cookie (Path=/oauth/google, 10 minutes) and redirects to Google's authorization page exactly like /oauth/google/login.

Not mounted unless Google sign-in is configured — 404 otherwise.