feat(auth): manage Google OAuth credentials from the database (epic 6b)

- Build the Google OAuth client lazily from sysconfig (DB override, env fallback) and re-register
  when the credentials change, so the install wizard / admin can set them without a restart.
- New 'google' config group (google_client_id/secret, encrypted) on the Configuration page; the
  token-refresh reads the creds the same way.
- Public GET /auth/config exposes google_enabled; the login page hides 'Continue with Google'
  when Google OAuth isn't configured (email+password still works).

backend/app/sysconfig.py

@@ -50,6 +50,10 @@ SPECS: tuple[ConfigSpec, ...] = (
     ConfigSpec("autotag_title_sample", "int", "batch", "autotag_title_sample", min=1, max=1_000),
     # --- YouTube Data API key (secret; optional — public reads prefer it over OAuth) ---
     ConfigSpec("youtube_api_key", "str", "youtube", "youtube_api_key", secret=True),
+    # --- Google OAuth client (Sign in with Google; both encrypted, env fallback). Set from the
+    #     install wizard / Configuration page so no restart is needed when the creds change. ---
+    ConfigSpec("google_client_id", "str", "google", "google_client_id", secret=True),
+    ConfigSpec("google_client_secret", "str", "google", "google_client_secret", secret=True),
     # --- Access / registration ---
     ConfigSpec("allow_registration", "bool", "access", "allow_registration"),
 )