GS: Google OAuth, Picker, and snapshot export

Parent: #398

Design:

• docs/design/google-sheets/authentication.md
• docs/design/google-sheets/snapshot-export.md
• docs/design/google-sheets/large-results.md

Scope

Add deployment-gated Google Identity Services authentication, Google Picker create/select flow, and one-time snapshot export using the canonical streaming/type-conversion pipeline.

Acceptance criteria

• Google actions are absent when configuration is missing.
• Tokens remain in browser memory and never enter URLs, logs, persistence, or exports.
• New and existing spreadsheets can be selected with edit-permission validation.
• Snapshot export creates no binding, refresh link, checkpoint, or history row.
• Values use RAW input semantics and precision-safe ClickHouse type mapping.
• Upload uses explicit byte-bounded ranges with progress, cancellation, quota backoff, and no silent truncation.
• OAuth popup/account/permission failures are actionable and non-destructive.
• Unit, fake-Google, browser, and scale tests cover the flow.

Non-goals

Linked refresh, server binding storage, scheduling, Apps Script, service accounts, and Google Docs.

Start with docs/design/google-sheets/authentication.md, docs/design/google-sheets/snapshot-export.md, and docs/design/google-sheets/large-results.md, then locate the existing streaming and type-conversion entry points. Done means the gated OAuth, Picker selection, and one-time export satisfy the listed security, upload, error-handling, and unit, fake-Google, browser, and scale-test criteria.