Gmail (app-password) onboarding: auth_strategy routing + credential-helper panel

Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal)
onboard via a provider app password on the existing plain-password sync path —
no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it
was previously un-addable.

Backend:
- presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes
  `auth: password` + `[app_password, oauth2]`. App-password providers ship a
  data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url).
- discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets
  load them and autoconfig candidates derive a default from the detected auth.
- schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds
  `google_oauth_enabled`.
- config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback.

Frontend:
- ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture),
  rendered steps, single paste field that strips whitespace, instant verify
  (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the
  auth_failed recovery branch with a gated "Sign in with Google instead" button.
- AccountWizard routes app-password providers to the panel, then a details step.
- i18n keys (en) for the panel + provider steps.

Honors the §6.2.2 prohibitions: no page automation, no real-password capture,
no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/app/accounts/schemas.py

@@ -22,11 +22,21 @@ class DiscoverRequest(BaseModel):
     email: str
 
 
+class HelpBlockOut(BaseModel):
+    help_id: str
+    deep_link: str
+    app_name_hint: str = ""
+    steps: list[str] = []
+    docs_url: str = ""
+
+
 class CandidateOut(BaseModel):
     imap: ServerConfigIn
     smtp: ServerConfigIn
     source: str
     oauth_provider: str | None = None
+    auth_strategy: list[str] = ["password"]
+    help: HelpBlockOut | None = None
 
 
 class DiscoveryStepOut(BaseModel):
@@ -38,6 +48,8 @@ class DiscoveryStepOut(BaseModel):
 class DiscoverResponse(BaseModel):
     candidates: list[CandidateOut]
     steps: list[DiscoveryStepOut]
+    # Whether the wizard may offer the Google OAuth fallback (SPEC §6.2.1).
+    google_oauth_enabled: bool = False
 
 
 class TestRequest(BaseModel):