Gmail (app-password) onboarding: auth_strategy routing + credential-helper panel

Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal)
onboard via a provider app password on the existing plain-password sync path —
no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it
was previously un-addable.

Backend:
- presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes
  `auth: password` + `[app_password, oauth2]`. App-password providers ship a
  data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url).
- discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets
  load them and autoconfig candidates derive a default from the detected auth.
- schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds
  `google_oauth_enabled`.
- config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback.

Frontend:
- ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture),
  rendered steps, single paste field that strips whitespace, instant verify
  (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the
  auth_failed recovery branch with a gated "Sign in with Google instead" button.
- AccountWizard routes app-password providers to the panel, then a details step.
- i18n keys (en) for the panel + provider steps.

Honors the §6.2.2 prohibitions: no page automation, no real-password capture,
no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/app/accounts/discovery.py

@@ -18,7 +18,13 @@ import yaml
 from defusedxml import ElementTree as SafeET
 
 from app.accounts.ssrf import SsrfError, assert_host_is_public, guarded_get
-from app.accounts.types import CandidateConfig, DiscoveryResult, DiscoveryStep, ServerConfig
+from app.accounts.types import (
+    CandidateConfig,
+    DiscoveryResult,
+    DiscoveryStep,
+    HelpBlock,
+    ServerConfig,
+)
 
 _PROBE_TIMEOUT = 5.0
 
@@ -28,6 +34,24 @@ _presets_cache: dict[str, CandidateConfig] | None = None
 # --- presets -----------------------------------------------------------------
 
 
+def _strategy_from_auth(auth: str) -> tuple[str, ...]:
+    """Default credential flow when a preset doesn't declare one (SPEC §6.2.1)."""
+    return ("oauth2",) if auth == "oauth2" else ("password",)
+
+
+def _help_block(raw: object) -> HelpBlock | None:
+    if not isinstance(raw, dict):
+        return None
+    steps = raw.get("steps", [])
+    return HelpBlock(
+        help_id=str(raw["help_id"]),
+        deep_link=str(raw["deep_link"]),
+        app_name_hint=str(raw.get("app_name_hint", "")),
+        steps=tuple(str(s) for s in steps) if isinstance(steps, list) else (),
+        docs_url=str(raw.get("docs_url", "")),
+    )
+
+
 def _load_presets() -> dict[str, CandidateConfig]:
     global _presets_cache
     if _presets_cache is None:
@@ -41,7 +65,15 @@ def _load_presets() -> dict[str, CandidateConfig]:
             smtp = ServerConfig(
                 prov["smtp"]["host"], prov["smtp"]["port"], prov["smtp"]["tls"], auth
             )
-            candidate = CandidateConfig(imap, smtp, "preset", prov.get("oauth_provider"))
+            strategy = tuple(prov.get("auth_strategy", [])) or _strategy_from_auth(auth)
+            candidate = CandidateConfig(
+                imap,
+                smtp,
+                "preset",
+                prov.get("oauth_provider"),
+                strategy,
+                _help_block(prov.get("help")),
+            )
             for domain in prov["domains"]:
                 mapping[domain.lower()] = candidate
         _presets_cache = mapping
@@ -91,7 +123,9 @@ def parse_autoconfig_xml(xml_text: str) -> CandidateConfig | None:
     smtp = _server("outgoingServer", "smtp")
     if imap is None or smtp is None:
         return None
-    return CandidateConfig(imap, smtp, "autoconfig")
+    return CandidateConfig(
+        imap, smtp, "autoconfig", auth_strategy=_strategy_from_auth(imap.auth)
+    )
 
 
 # --- DNS SRV (RFC 6186) ------------------------------------------------------
@@ -191,7 +225,14 @@ async def _try_http_config(url: str, source: str) -> CandidateConfig | None:
     candidate = parse_autoconfig_xml(xml_text)
     if candidate is None:
         return None
-    return CandidateConfig(candidate.imap, candidate.smtp, source, candidate.oauth_provider)
+    return CandidateConfig(
+        candidate.imap,
+        candidate.smtp,
+        source,
+        candidate.oauth_provider,
+        candidate.auth_strategy,
+        candidate.help,
+    )
 
 
 async def discover(email: str) -> DiscoveryResult: