Start Google OAuth flow (sign-in)

Redirects to Google's authorization page (scope=openid email, prompt=select_account). Sets an oauth_google_state cookie (Path=/oauth/google) for CSRF protection, distinct from GitHub's oauth_state cookie.

Not mounted at all unless GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET/ GOOGLE_REDIRECT_URI are all configured — 404 otherwise.

This route is sign-in only. A stray link_ticket query parameter is ignored outright and any stale oauth_google_link cookie is cleared — identity-link starts only via POST /oauth/google/link, never a GET query string (a bearer ticket in a URL would stay live in server/proxy access logs for the full 10-minute window it remains valid).