Support multiple Google OAuth accounts

[wflanagan]

Summary

• classify the first Google connection automatically as personal or Workspace
• let users add, reconnect, and revoke a second Google account independently
• expose stable account-specific connector variables while retaining the primary alias for existing skills and grants
• force account selection and reject identity/slot mismatches

Verification

• npm run lint
• npm run typecheck
• 84 focused OAuth, connector, orchestrator, and web UI tests
• independent security and runtime reviews
• deployed against a production Fly instance with both account slots connected
• read-only Gmail, Calendar, and Drive checks passed for both work and personal accounts

Demo

Live deployment: https://audienti-portal.fly.dev/keychain

The production Keychain renders both accounts under one Google Workspace card:

Account	Gmail	Calendar	Drive
Work Google	Pass	Pass	Pass
Personal Google	Pass	Pass	Pass

The first connection auto-classified the Workspace identity. Add another account then forced the Google account picker and populated the personal slot. The smoke test used only per-user connector tokens; no deployment-wide Google refresh token was available.