Chat MCP API (chatmcp.googleapis.com) returns PERMISSION_DENIED on all calls across two independent GCP projects

## Summary

Every call through the Google Chat MCP connector — `search_conversations`, `search_messages`, `send_message` — fails immediately with:

```
The caller does not have permission
```

This happens identically across **two independently configured Google Cloud projects** (set up hours apart, one from scratch), both fully and correctly configured. This rules out project-specific misconfiguration and points to an issue with the Chat MCP bridge (`chatmcp.googleapis.com`) itself, or how the connector authenticates against it.

## Environment

- Google Workspace domain: processperfect.com.au
- Projects tested: `claude-code-mcp-489304` (existing) and `chat-mcp-test-505522` (built from scratch to isolate the issue)

## Verified correct on both projects

- Chat MCP API + Google Chat API enabled
- OAuth consent screen: External, Testing, test user added (james@processperfect.com.au)
- All relevant scopes granted: chat.spaces(.readonly), chat.messages(.readonly), chat.messages.create, chat.memberships(.readonly), chat.messages.reactions, chat.users.readstate.readonly
- OAuth client: Web application, redirect URI `https://claude.ai/api/mcp/auth_callback`, Client ID/Secret confirmed matching Claude's connector config
- Google Workspace Admin → App access control: Chat set to Unrestricted, nothing blocked
- Google Account (myaccount.google.com/connections) shows full Chat scope grant
- App verification not required (Testing mode)

## Steps to reproduce

1. Set up a GCP project per the above (Chat MCP API + Chat API enabled, OAuth consent w/ Chat scopes, test user, Web OAuth client w/ Claude's redirect URI).
2. Add a custom connector in Claude pointing at `https://chatmcp.googleapis.com/mcp/v1` with that Client ID/Secret.
3. Authorize (consent completes with no errors).
4. Call `search_conversations`, `search_messages`, or `send_message`.

**Expected:** success. **Actual:** `The caller does not have permission`, every time.

## Why this isn't a config issue

Repeated the full setup from scratch in a second brand-new project with newly generated credentials and a fresh authorization — identical failure. Historical metrics on the original project also show `chatmcp.googleapis.com`'s `SearchConversations`/`SearchMessages` methods at a 100% error rate (9/9 requests over 30 days).

## Ask

Please check whether `chatmcp.googleapis.com` requires additional provisioning/allowlisting beyond what's documented in Cloud Console, and whether this is a known/broader issue.

Test project OAuth Client ID (for log correlation): `684675593002-tnnn5pn9tf66fmuoeoc0a64helemb3n8.apps.googleusercontent.com`