feat(scouts): gmail pub/sub webhook with JWT verification

app/config/settings.py

@@ -62,6 +62,11 @@ class Settings(BaseSettings):
     # Full resource name, e.g. "projects/my-project/topics/gmail-push".
     # Leave empty in dev — setup_watch will skip registration gracefully.
     GMAIL_PUBSUB_TOPIC: str = ""
+    # OIDC token audience for Pub/Sub push subscription JWT verification.
+    # Set to the service account email or audience string configured in the
+    # Pub/Sub push subscription. Leave empty in dev to skip verification
+    # (a warning is logged — never silent in production).
+    GMAIL_PUBSUB_AUDIENCE: str = ""
 
     # Fernet key (URL-safe base64, 32-byte key) for at-rest encryption of OAuth
     # tokens stored in cloud_agent_configs.oauth_token_encrypted.