GS: Refresh history, repair, and unlink workflows

Parent: #398
Depends on: #400, #401, #402

Design:

• docs/design/google-sheets/failure-recovery.md
• docs/design/google-sheets/spreadsheet-layout.md
• docs/design/google-sheets/sharing-security.md

Scope

Add refresh audit history, normalized diagnostics, broken-link indicators, repair actions, copied-spreadsheet handling, unlink, and managed-sheet removal.

Acceptance criteria

• Successful and failed refreshes append safe audit records with mode, phase, counts, duration, identities, and normalized error category.
• Tokens, credentials, and sensitive parameters never enter audit rows.
• UI exposes last status and refresh history per binding.
• Repair supports deleted managed sheets, stale staging, renamed resources, copied spreadsheets, Google reauthorization, source rebinding, and checkpoint reset through explicit full refresh.
• Repair never guesses resource identity from sheet names.
• Unlink disables future refresh and removes refresh metadata while preserving exported data by default.
• Removing managed worksheets is a separate destructive action.
• SQL Browser does not delete the entire spreadsheet.
• Broken bindings remain diagnosable and do not mutate destination data automatically.

Non-goals

Strict distributed locking, automatic repair, or Google file deletion.

Comienza con docs/design/google-sheets/failure-recovery.md, spreadsheet-layout.md y sharing-security.md; después revisa el issue principal #398 y las dependencias #400, #401 y #402. Implementa y verifica los comportamientos enumerados de historial de actualizaciones, diagnósticos, reparación, desvinculación y eliminación de hojas administradas, incluidos registros de auditoría seguros, datos exportados preservados y ninguna mutación automática del destino.