GS: Refresh history, repair, and unlink workflows

Parent: #398
Depends on: #400, #401, #402

Design:

• docs/design/google-sheets/failure-recovery.md
• docs/design/google-sheets/spreadsheet-layout.md
• docs/design/google-sheets/sharing-security.md

Scope

Add refresh audit history, normalized diagnostics, broken-link indicators, repair actions, copied-spreadsheet handling, unlink, and managed-sheet removal.

Acceptance criteria

• Successful and failed refreshes append safe audit records with mode, phase, counts, duration, identities, and normalized error category.
• Tokens, credentials, and sensitive parameters never enter audit rows.
• UI exposes last status and refresh history per binding.
• Repair supports deleted managed sheets, stale staging, renamed resources, copied spreadsheets, Google reauthorization, source rebinding, and checkpoint reset through explicit full refresh.
• Repair never guesses resource identity from sheet names.
• Unlink disables future refresh and removes refresh metadata while preserving exported data by default.
• Removing managed worksheets is a separate destructive action.
• SQL Browser does not delete the entire spreadsheet.
• Broken bindings remain diagnosable and do not mutate destination data automatically.

Non-goals

Strict distributed locking, automatic repair, or Google file deletion.

Beginne mit docs/design/google-sheets/failure-recovery.md, spreadsheet-layout.md und sharing-security.md und prüfe anschließend den übergeordneten Issue #398 sowie die Abhängigkeiten #400, #401 und #402. Implementiere und verifiziere die aufgeführten Verhaltensweisen für Aktualisierungsverlauf, Diagnostik, Reparatur, Aufheben der Verknüpfung und das Entfernen verwalteter Tabellenblätter, einschließlich sicherer Audit-Datensätze, erhaltener exportierter Daten und keiner automatischen Änderung des Ziels.