feat(auth): show the Google address beside the one the account registered with (E9.5 S3)

An account can now hold two true addresses: the one its owner typed, which a Google
sign-in no longer overwrites, and the one Google answers with. Only the first was
stored, so Settings could say 'Connected' without saying connected AS WHOM -- exactly
what someone who registered with a +tag needs to know.

users.google_email (migration 0080) records Google's answer at sign-in and at an
in-app link. /api/me exposes it ONLY when it differs from the account address, so the
comparison lives in one place and the majority, whose two addresses are the same
string, see no change at all. Rendered in the account menu as a muted third line under
the identity, and in the Settings sign-in row under the existing hint.

A short 'Google' label rather than a brand glyph: the app draws one icon set (lucide),
and a generic mail icon next to an email address says nothing. It also reads to a
screen reader, which an unlabelled logo would not.

No backfill is possible -- Google's answer is only known at sign-in -- so accounts
linked earlier stay NULL until their owner next signs in with Google.

frontend/src/components/NavSidebar.tsx

@@ -281,6 +281,20 @@ export default function NavSidebar({
                 <div className="min-w-0">
                   <div className="text-sm font-semibold truncate">{name}</div>
                   <div className="text-xs text-muted truncate">{me.email}</div>
+                  {/* The address Google answers with, when it isn't the one above. /api/me sends it
+                      only when the two differ, so for most accounts this line never exists — and for
+                      someone who registered as `me+siftlode@gmail.com` it answers the question their
+                      sign-in screen would otherwise leave open: which address gets me in? A text
+                      label rather than a brand glyph, since the app draws one icon set (lucide) and a
+                      generic mail icon here would say nothing. */}
+                  {me.google_email && (
+                    <div
+                      className="text-2xs text-muted truncate mt-0.5"
+                      title={t("header.account.googleAddress", { email: me.google_email })}
+                    >
+                      <span className="uppercase tracking-wide">Google</span> · {me.google_email}
+                    </div>
+                  )}
                 </div>
               </div>
               {me.role === "admin" && (

frontend/src/components/SettingsPanel.tsx

@@ -413,6 +413,15 @@ function SignInMethods({ me }: { me: Me }) {
                 ? t("settings.account.googleLink.connectedHint")
                 : t("settings.account.googleLink.connectHint")}
             </p>
+            {/* Which address Google actually answers with — sent only when it differs from the
+                account's own (see /api/me). "Connected" alone left that unanswerable, and it is
+                exactly what someone who registered with a `+tag` needs to know. */}
+            {me.google_email && (
+              <p className="text-xs text-fg/80 mt-1.5">
+                <span className="text-muted">{t("settings.account.googleLink.signedInAs")}</span>{" "}
+                {me.google_email}
+              </p>
+            )}
           </div>
           {me.has_google ? (
             <span className="shrink-0 text-2xs px-2 py-1 rounded-full border border-accent/40 text-accent">

frontend/src/i18n/locales/en/header.json

@@ -34,7 +34,8 @@
     "signOut": "Sign out",
     "addAccount": "Add another account",
     "switchTo": "Switch to {{name}}",
-    "audit": "Audit log"
+    "audit": "Audit log",
+    "googleAddress": "Google account: {{email}}"
   },
   "sync": {
     "yours": "yours",

frontend/src/i18n/locales/en/settings.json

@@ -78,7 +78,8 @@
       "linked": "Google account linked.",
       "conflict": "That Google account is already linked to a different Siftlode account.",
       "mismatch": "That's a different Google account than the one already linked here. Sign in with the linked one.",
-      "error": "Couldn't link the Google account. Please try again."
+      "error": "Couldn't link the Google account. Please try again.",
+      "signedInAs": "Signed in with Google as"
     },
     "googleCancelled": "Google sign-in was cancelled.",
     "password": {

frontend/src/i18n/locales/hu/header.json

@@ -34,7 +34,8 @@
     "signOut": "Kijelentkezés",
     "addAccount": "Másik fiók hozzáadása",
     "switchTo": "Váltás erre: {{name}}",
-    "audit": "Naplózás"
+    "audit": "Naplózás",
+    "googleAddress": "Google-fiók: {{email}}"
   },
   "sync": {
     "yours": "tiéd",

frontend/src/i18n/locales/hu/settings.json

@@ -78,7 +78,8 @@
       "linked": "Google-fiók összekapcsolva.",
       "conflict": "Ez a Google-fiók már egy másik Siftlode-fiókhoz van kapcsolva.",
       "mismatch": "Ez nem az a Google-fiók, amely ide már össze van kapcsolva. Az összekapcsolttal jelentkezz be.",
-      "error": "Nem sikerült összekapcsolni a Google-fiókot. Próbáld újra."
+      "error": "Nem sikerült összekapcsolni a Google-fiókot. Próbáld újra.",
+      "signedInAs": "Google-belépés ezzel a címmel:"
     },
     "googleCancelled": "A Google-belépés megszakadt.",
     "password": {

frontend/src/lib/api/account.ts

@@ -10,6 +10,10 @@ export interface Me {
   role: string;
   is_demo: boolean;
   has_google: boolean;
+  /** The address Google answers with, ONLY when it differs from `email` — the backend does that
+   * comparison, so a surface can render this whenever it is present. Someone who registered as
+   * `me+siftlode@gmail.com` keeps that address; this is the other one that also signs them in. */
+  google_email: string | null;
   has_password: boolean;
   google_enabled: boolean;
   plex_enabled: boolean;