Gmail (app-password) onboarding: auth_strategy routing + credential-helper panel

Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal)
onboard via a provider app password on the existing plain-password sync path —
no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it
was previously un-addable.

Backend:
- presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes
  `auth: password` + `[app_password, oauth2]`. App-password providers ship a
  data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url).
- discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets
  load them and autoconfig candidates derive a default from the detected auth.
- schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds
  `google_oauth_enabled`.
- config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback.

Frontend:
- ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture),
  rendered steps, single paste field that strips whitespace, instant verify
  (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the
  auth_failed recovery branch with a gated "Sign in with Google instead" button.
- AccountWizard routes app-password providers to the panel, then a details step.
- i18n keys (en) for the panel + provider steps.

Honors the §6.2.2 prohibitions: no page automation, no real-password capture,
no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

backend/app/api/accounts.py

@@ -17,6 +17,7 @@ from app.accounts.schemas import (
     DiscoverRequest,
     DiscoverResponse,
     DiscoveryStepOut,
+    HelpBlockOut,
     ServerConfigIn,
     TestRequest,
     TestResponse,
@@ -27,6 +28,7 @@ from app.accounts.testing import AccountTestError, test_account
 from app.accounts.types import CandidateConfig, ServerConfig
 from app.api.errors import raise_api_error
 from app.api.schemas import AccountOut
+from app.config import get_settings
 from app.db import get_session
 from app.identity.deps import CurrentUser, require_csrf
 from app.models import Account
@@ -62,6 +64,18 @@ def _candidate_out(c: CandidateConfig) -> CandidateOut:
         smtp=_server_in(c.smtp),
         source=c.source,
         oauth_provider=c.oauth_provider,
+        auth_strategy=list(c.auth_strategy),
+        help=(
+            HelpBlockOut(
+                help_id=c.help.help_id,
+                deep_link=c.help.deep_link,
+                app_name_hint=c.help.app_name_hint,
+                steps=list(c.help.steps),
+                docs_url=c.help.docs_url,
+            )
+            if c.help
+            else None
+        ),
     )
 
 
@@ -109,6 +123,7 @@ async def discover_account(body: DiscoverRequest, user: CurrentUser) -> Discover
             DiscoveryStepOut(method=s.method, status=s.status, detail=s.detail)
             for s in result.steps
         ],
+        google_oauth_enabled=get_settings().google_oauth_enabled,
     )