GS: Refresh history, repair, and unlink workflows

Parent: #398
Depends on: #400, #401, #402

Design:

• docs/design/google-sheets/failure-recovery.md
• docs/design/google-sheets/spreadsheet-layout.md
• docs/design/google-sheets/sharing-security.md

Scope

Add refresh audit history, normalized diagnostics, broken-link indicators, repair actions, copied-spreadsheet handling, unlink, and managed-sheet removal.

Acceptance criteria

• Successful and failed refreshes append safe audit records with mode, phase, counts, duration, identities, and normalized error category.
• Tokens, credentials, and sensitive parameters never enter audit rows.
• UI exposes last status and refresh history per binding.
• Repair supports deleted managed sheets, stale staging, renamed resources, copied spreadsheets, Google reauthorization, source rebinding, and checkpoint reset through explicit full refresh.
• Repair never guesses resource identity from sheet names.
• Unlink disables future refresh and removes refresh metadata while preserving exported data by default.
• Removing managed worksheets is a separate destructive action.
• SQL Browser does not delete the entire spreadsheet.
• Broken bindings remain diagnosable and do not mutate destination data automatically.

Non-goals

Strict distributed locking, automatic repair, or Google file deletion.

Start with docs/design/google-sheets/failure-recovery.md, spreadsheet-layout.md, and sharing-security.md, then review parent #398 and dependencies #400, #401, and #402. Implement and verify the listed refresh history, diagnostics, repair, unlink, and managed-sheet removal behaviors, including safe audit records, preserved exported data, and no automatic destination mutation.