Require end-user scopes for Gmail OAuth routes

[ltyu]

Summary

• require gmail:connect and gmail:disconnect scopes on the protected OAuth routes at API Gateway
• reject client-credentials tokens and missing scopes in the JWT-backed app user provider for defense in depth
• document the new Auth0 API scopes and clarify that machine-to-machine tokens cannot be used for connect or disconnect

Testing

• pnpm test:run -- src/services/jwtAuthenticatedAppUserProvider.test.ts src/handlers/startGoogleOAuth.test.ts src/handlers/disconnectGoogleOAuth.test.ts
• pnpm exec tsc --noEmit