Make Google OAuth flow SPA-friendly

[ltyu]

Summary

• return the Google consent URL as JSON from /auth/google/start so SPA clients can fetch it with a Bearer token and redirect the browser themselves
• make /auth/google/callback public while keeping state-based validation so Google can complete the redirect without app auth headers
• allow http://localhost:3000 in the HttpApi CORS config for local SPA development and document the updated flow