feat(onboarding): first-login wizard for incremental YouTube consent

After the clean name/email sign-in, a wizard walks the user through granting
YouTube read (then optionally write) one step at a time, each with a plain
rationale and an up-front heads-up about Google's "unverified app" screen.

The visible step is derived from the granted scopes (can_read/can_write) so the
flow resumes correctly across the full-page consent redirect; it's dismissible
and reopenable from Settings -> Account, which now lists read and write as
separate, individually-grantable access rows.

frontend/src/lib/api.ts

@@ -6,6 +6,7 @@ export interface Me {
   display_name: string | null;
   avatar_url: string | null;
   role: string;
+  can_read: boolean;
   can_write: boolean;
   pending_invites: number;
   preferences: Record<string, any>;