Three new endpoints under /api/v1/scouts/oauth/gmail/:
GET /authorize — PKCE consent URL for gmail.readonly + gmail.modify scopes
GET /web-callback — bounces to adiuvai:// deep link (excluded from schema)
POST /callback — exchanges code, encrypts + stores token, triggers setup_watch
State TTL 10 min, in-memory (same pattern as auth.py _pending_states).
Redirect URI base derived from existing OAUTH_REDIRECT_URI setting.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
11b31e5814