refactor(auth): one Google connect route for a sign-in and for YouTube access

/auth/link and /auth/upgrade become /auth/google/connect?access=identity|read|write: one handler, one
table of what each access asks Google for, the same callback markers. An unknown access is refused
(422) instead of quietly meaning read, and an instance without Google answers ?link=error for a
grant too, not a silent return to the app. The frontend builds the URL in lib/googleConnect, and a
contract test holds it to the backend route and its access values.

frontend/src/lib/googleConnect.ts

@@ -0,0 +1,16 @@
+// Every in-app Google round-trip starts at one backend route (auth.py `google_connect`): attaching a
+// Google sign-in to the account (`identity`), or granting YouTube access on top (`read`, `write`).
+// The page navigates away to Google and comes back through the shared callback, which lands on
+// `?link=…` (App.tsx) for `identity` and on the app itself for a grant.
+
+export const GOOGLE_ACCESS = ["identity", "read", "write"] as const;
+export type GoogleAccess = (typeof GOOGLE_ACCESS)[number];
+
+export function googleConnectUrl(access: GoogleAccess): string {
+  return `/auth/google/connect?access=${access}`;
+}
+
+/** Leave for Google's sign-in or consent screen. */
+export function connectGoogle(access: GoogleAccess): void {
+  window.location.href = googleConnectUrl(access);
+}