Refactor: extract GoogleOAuthClient service and adopt interface/type naming conventions

[ltyu]

Summary

• Extract GoogleOAuthClient service — moves three hanging module-level functions (exchangeCodeForTokens, getGoogleAccountProfile, buildConsentUrl) out of googleOAuthCallback.ts and startGoogleOAuth.ts into a dedicated GoogleOAuthClient class in src/services/. Handlers now depend on the IGoogleOAuthClient interface, keeping Google SDK details out of handler files.

• Adopt interface vs type naming conventions — all exported public-contract interfaces are prefixed with I (e.g. IGmailService, IOAuthStateRepository). File-local dependency bags, config objects, and internal DynamoDB item shapes are converted from interface to type and drop the I prefix, since they are never implemented or extended.

• Update AGENTS.md — documents the interface/type distinction so future agents and contributors follow the same pattern.

Changed files

File	Change
src/services/googleOAuthClient.ts	New — GoogleOAuthClient class with 3 methods
src/types.ts	Add IGoogleOAuthClient, ITokenExchangeResult, IGoogleAccountProfile; prefix all 23 exported interfaces with I
src/handlers/googleOAuthCallback.ts	Replace two function deps with googleOAuthClient; config/deps shapes → type
src/handlers/startGoogleOAuth.ts	Thread googleOAuthClient through deps; config/deps shapes → type
src/repositories/dynamoDb*.ts	Internal item shapes → type, drop I prefix
src/services/*.ts, src/utils/*.ts, src/handler.ts	Update imports to renamed I-prefixed interfaces
src/handler.test.ts, src/handlers/*.test.ts	Update mocks to match new dep shape
AGENTS.md	Document interface vs type rule