feat: granular permissions for Google Drive integration

[jeremyeder]

Summary

Implements file-level (drive.file) permissions for Google Drive integration (#918), replacing the default full-drive access scope. Users select specific files via the Google Picker instead of granting access to all Drive files.

• Backend: OAuth scope defaults to drive.file, new handlers for integration lifecycle and file grant CRUD, K8s ConfigMap/Secret storage, Unleash feature flag gating
• Frontend: Google Picker component, file selection summary, setup/settings pages, drive API client with React Query hooks
• Specs: Full speckit artifacts (spec, plan, tasks, research, data-model, API contract, checklists)
• Tests: 80 tests (40 backend + 40 frontend), all passing

Key changes

• components/backend/models/drive.go — DriveIntegration and FileGrant models with state machines
• components/backend/handlers/drive_*.go — integration, file grants, storage, routes
• components/backend/handlers/oauth.go — scope constants and GetGoogleDriveScopes() helper
• components/frontend/src/services/drive-api.ts — API client with React Query hooks
• components/frontend/src/components/google-picker/ — Picker and file summary components
• components/frontend/src/pages/integrations/google-drive/ — setup and settings pages
• specs/001-granular-drive-permissions/ — speckit artifacts

Test plan

• Backend model tests: state transitions, validation, field mapping (10 tests)
• Backend storage tests: ConfigMap/Secret CRUD round-trips with fake k8s (14 tests)
• Backend handler tests: HTTP handler responses, error cases (16 tests)
• Frontend API tests: fetch calls, error handling, query keys (15 tests)
• Frontend component tests: rendering, icons, badges, formatting (20 tests)
• Frontend loader tests: script loading, caching (5 tests)
• All pre-commit hooks pass (gofmt, go vet, golangci-lint, eslint)

Closes #918

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 49c14f0d-454a-4614-9a9a-976782421fe1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch feat/granular-drive-permissions-918

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

You can validate your CodeRabbit configuration file in your editor.

If your editor has YAML language server, you can enable auto-completion and validation by adding # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json at the top of your CodeRabbit configuration file.