fix(setup): hide YouTube/Google affordances when Google sign-in isn't configured

- /api/me exposes instance-wide google_enabled. The onboarding nudge no longer auto-opens, and
  Settings hides the YouTube-access section + the 'Connect Google' option, when the instance has
  no Google OAuth configured (e.g. an email+password-only self-host). A linked account still shows
  its 'Connected' status.

frontend/src/components/SettingsPanel.tsx

@@ -389,34 +389,40 @@ function SignInMethods({ me }: { me: Me }) {
   const inputCls =
     "w-full bg-card border border-border rounded-xl px-3 py-2 text-sm outline-none focus:border-accent";
 
+  // Offer Google only when this instance has Google OAuth configured (or the account is already
+  // linked — then we still show its "Connected" status even if the instance creds were removed).
+  const showGoogle = me.google_enabled || me.has_google;
+
   return (
     <Section title={t("settings.account.signInMethods")}>
-      <div className="flex items-start justify-between gap-3 py-2">
-        <div className="min-w-0">
-          <div className="text-sm font-medium">{t("settings.account.googleLink.title")}</div>
-          <p className="text-xs text-muted leading-relaxed mt-0.5">
-            {me.has_google
-              ? t("settings.account.googleLink.connectedHint")
-              : t("settings.account.googleLink.connectHint")}
-          </p>
+      {showGoogle && (
+        <div className="flex items-start justify-between gap-3 py-2">
+          <div className="min-w-0">
+            <div className="text-sm font-medium">{t("settings.account.googleLink.title")}</div>
+            <p className="text-xs text-muted leading-relaxed mt-0.5">
+              {me.has_google
+                ? t("settings.account.googleLink.connectedHint")
+                : t("settings.account.googleLink.connectHint")}
+            </p>
+          </div>
+          {me.has_google ? (
+            <span className="shrink-0 text-[11px] px-2 py-1 rounded-full border border-accent/40 text-accent">
+              {t("settings.account.googleLink.connected")}
+            </span>
+          ) : (
+            <button
+              onClick={() => {
+                window.location.href = "/auth/link";
+              }}
+              className="shrink-0 glass-card glass-hover px-3 py-1.5 rounded-xl text-sm transition"
+            >
+              {t("settings.account.googleLink.connect")}
+            </button>
+          )}
         </div>
-        {me.has_google ? (
-          <span className="shrink-0 text-[11px] px-2 py-1 rounded-full border border-accent/40 text-accent">
-            {t("settings.account.googleLink.connected")}
-          </span>
-        ) : (
-          <button
-            onClick={() => {
-              window.location.href = "/auth/link";
-            }}
-            className="shrink-0 glass-card glass-hover px-3 py-1.5 rounded-xl text-sm transition"
-          >
-            {t("settings.account.googleLink.connect")}
-          </button>
-        )}
-      </div>
+      )}
 
-      <div className="border-t border-border mt-1 pt-1">
+      <div className={showGoogle ? "border-t border-border mt-1 pt-1" : ""}>
         <div className="flex items-start justify-between gap-3 py-2">
           <div className="min-w-0">
             <div className="text-sm font-medium">{t("settings.account.password.title")}</div>
@@ -517,7 +523,8 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
           {t("settings.account.demoNotice")}
         </p>
       </Section>
-    ) : (
+    ) : me.google_enabled ? (
+      // YouTube access requires Google OAuth; hidden when this instance has no Google configured.
       <Section title={t("settings.account.youtubeAccess")}>
         <p className="text-xs text-muted leading-relaxed mb-1">
           {t("settings.account.youtubeAccessIntro")}
@@ -549,7 +556,7 @@ function Account({ me, onOpenWizard }: { me: Me; onOpenWizard: () => void }) {
           {t("settings.account.walkMeThrough")}
         </button>
       </Section>
-    )}
+    ) : null}
 
     {!me.is_demo && (
       <Section title={t("settings.account.dangerZone")}>

frontend/src/lib/api.ts

@@ -11,6 +11,7 @@ export interface Me {
   is_demo: boolean;
   has_google: boolean;
   has_password: boolean;
+  google_enabled: boolean;
   can_read: boolean;
   can_write: boolean;
   pending_invites: number;

frontend/src/lib/onboarding.ts

@@ -15,9 +15,16 @@
 export const ONBOARD_ACTIVE = "subfeed.onboarding.active";
 export const ONBOARD_DISMISSED = "subfeed.onboarding.dismissed";
 
-export function shouldAutoOpenOnboarding(me: { can_read: boolean; is_demo?: boolean }): boolean {
+export function shouldAutoOpenOnboarding(me: {
+  can_read: boolean;
+  is_demo?: boolean;
+  google_enabled?: boolean;
+}): boolean {
   // The shared demo account can never connect YouTube, so never nudge it to.
   if (me.is_demo) return false;
+  // YouTube connect needs Google OAuth configured on this instance. A self-host instance may run
+  // email+password only — then there's nothing to connect, so don't nudge.
+  if (me.google_enabled === false) return false;
   if (sessionStorage.getItem(ONBOARD_ACTIVE)) return true;
   return !me.can_read && !localStorage.getItem(ONBOARD_DISMISSED);
 }