Gmail (app-password) onboarding: auth_strategy routing + credential-helper panel

Implements SPEC v1.5 §6.2.1–6.2.3 so Gmail (and Yahoo/iCloud/Outlook-personal)
onboard via a provider app password on the existing plain-password sync path —
no OAuth, no new sync code. Gmail was oauth2-only with OAuth unimplemented, so it
was previously un-addable.

Backend:
- presets.yaml: each preset declares an ordered `auth_strategy`; Gmail becomes
  `auth: password` + `[app_password, oauth2]`. App-password providers ship a
  data-driven `help:` block (deep_link, app_name_hint, i18n step keys, docs_url).
- discovery/types: CandidateConfig carries `auth_strategy` + `HelpBlock`; presets
  load them and autoconfig candidates derive a default from the detected auth.
- schemas/api: CandidateOut exposes auth_strategy + help; DiscoverResponse adds
  `google_oauth_enabled`.
- config: GOOGLE_OAUTH_ENABLED flag (default false) gates the OAuth fallback.

Frontend:
- ProviderCredentialPanel (wizard step 1.5): deep-link popup (user gesture),
  rendered steps, single paste field that strips whitespace, instant verify
  (auto POST /accounts/test at 16 chars → Connected ✓ / mapped error), and the
  auth_failed recovery branch with a gated "Sign in with Google instead" button.
- AccountWizard routes app-password providers to the panel, then a details step.
- i18n keys (en) for the panel + provider steps.

Honors the §6.2.2 prohibitions: no page automation, no real-password capture,
no scraping — deep-link + guide + paste + test only. Adds the v1.5 spec.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01U72FZiF1W1pb8XxyWBTREA

frontend/src/i18n/en.ts

@@ -250,6 +250,43 @@ export const en = {
   "wizard.syncWindow.new.hint":
     "Nothing from before now — download older mail anytime from account settings.",
 
+  // Provider credential-helper panel (app passwords, SPEC §6.2.2).
+  "wizard.appPassword.title": "Create an app password",
+  "wizard.appPassword.intro":
+    "This provider needs a one-time app password instead of your normal password. Open the page below, generate one, and paste it here.",
+  "wizard.appPassword.open": "Open {provider} app passwords",
+  "wizard.appPassword.appNameHint": "Suggested name: {hint}",
+  "wizard.appPassword.pastePlaceholder": "Paste the app password",
+  "wizard.appPassword.verifying": "Verifying…",
+  "wizard.appPassword.connected": "Connected ✓",
+  "wizard.appPassword.docs": "Provider help",
+  "wizard.appPassword.useManual": "Enter server settings manually",
+  "wizard.appPassword.provider.gmail": "Google",
+  "wizard.appPassword.provider.yahoo": "Yahoo",
+  "wizard.appPassword.provider.icloud": "iCloud",
+  "wizard.appPassword.provider.outlook": "Microsoft",
+  // auth_failed recovery branch (the two real dead-ends).
+  "wizard.appPassword.failTitle": "That password didn't work",
+  "wizard.appPassword.failCauses":
+    "Common causes: 2-Step Verification isn't fully enabled yet; a brand-new account for which the provider withholds app passwords until it ages; or a work/school account where an admin disabled the feature.",
+  "wizard.appPassword.oauthInstead": "Sign in with Google instead",
+  // Gmail steps.
+  "wizard.help.gmail.step1": "Turn on 2-Step Verification for your Google account if you haven't.",
+  "wizard.help.gmail.step2": "On the App passwords page, name the password (e.g. \"ultimo.email\") and create it.",
+  "wizard.help.gmail.step3": "Copy the 16-character password and paste it below.",
+  // Outlook / Microsoft personal steps.
+  "wizard.help.outlook.step1": "Turn on two-step verification in your Microsoft account security settings.",
+  "wizard.help.outlook.step2": "Under Advanced security options, create a new app password.",
+  "wizard.help.outlook.step3": "Copy the generated password and paste it below.",
+  // Yahoo steps.
+  "wizard.help.yahoo.step1": "Open Account Security and turn on two-step verification.",
+  "wizard.help.yahoo.step2": "Choose \"Generate app password\" and name it.",
+  "wizard.help.yahoo.step3": "Copy the password and paste it below.",
+  // iCloud steps.
+  "wizard.help.icloud.step1": "Turn on two-factor authentication for your Apple Account.",
+  "wizard.help.icloud.step2": "Under Sign-In and Security, generate an app-specific password.",
+  "wizard.help.icloud.step3": "Copy the password and paste it below.",
+
   "settings.title": "Settings",
   "settings.profile": "Profile",
   "settings.security": "Security",