feat: provide first-party Google OAuth onboarding

## Goal

Let normal users authorize Diffler with `diffler auth login` without creating their own Google Cloud project or downloading an OAuth client file.

## Scope

- Register and brand a production Google OAuth application for Diffler.
- Configure the consent screen, support contact, authorized domains, privacy policy, terms if required, and production audience.
- Submit the `forms.body` scope for Google verification and document the review status and launch constraints.
- Define and review the installed-application client threat model: desktop client identifiers cannot be treated as confidential; PKCE, state, loopback binding, minimal scopes, and OS-keychain storage remain mandatory.
- Add a first-party client path for `diffler auth login`.
- Preserve `--credentials ` as an explicit bring-your-own-client and development option.
- Keep first-party client configuration separate from refresh credentials and ensure no downloadable OAuth JSON file is published accidentally.
- Add clear handling for unverified-app, Workspace administrator policy, revoked grant, quota, and first-party client unavailability errors.
- Document Google Account revocation and local logout behavior.

## Acceptance Criteria

- A public test user can run `diffler auth login`, approve consent in the system browser, and publish a Form without opening Google Cloud Console.
- Later runs refresh authorization without another consent flow.
- Bring-your-own-client login continues to work.
- OAuth client material and user refresh tokens never appear in logs, model context, Git history, npm metadata, or GitHub Actions output.
- The production consent screen requests only scopes required by current Diffler features.
- The repository documents the operational owner, verification state, quota monitoring, rotation/revocation procedure, and incident response.

## External Dependency

Google verification and production approval may take time. Begin this issue early and track implementation work separately from approval waiting where useful.