refactor(auth): one Google connect route for a sign-in and for YouTube access

/auth/link and /auth/upgrade become /auth/google/connect?access=identity|read|write: one handler, one
table of what each access asks Google for, the same callback markers. An unknown access is refused
(422) instead of quietly meaning read, and an instance without Google answers ?link=error for a
grant too, not a silent return to the app. The frontend builds the URL in lib/googleConnect, and a
contract test holds it to the backend route and its access values.

frontend/src/lib/onboarding.ts

@@ -12,7 +12,7 @@
 //                                       suppresses the auto-popup on future logins (they
 //                                       can still reopen it from Settings → Account).
 
-import { withActiveAccount } from "./activeAccount";
+import { connectGoogle } from "./googleConnect";
 import { getAccountRaw, LS, setAccountRaw } from "./storage";
 
 const ONBOARD_ACTIVE = "siftlode.onboarding.active"; // sessionStorage (not in LS, which is localStorage)
@@ -34,7 +34,7 @@ export function shouldAutoOpenOnboarding(me: {
 /** Mark a grant as in progress, then send the user to Google's consent screen. */
 export function beginGrant(access: "read" | "write"): void {
   sessionStorage.setItem(ONBOARD_ACTIVE, "1");
-  window.location.href = withActiveAccount(`/auth/upgrade?access=${access}`);
+  connectGoogle(access);
 }
 
 /** Leave the wizard. `dismiss` suppresses the future auto-popup (used when read is skipped). */