feat(auth): manage Google OAuth credentials from the database (epic 6b)

- Build the Google OAuth client lazily from sysconfig (DB override, env fallback) and re-register
  when the credentials change, so the install wizard / admin can set them without a restart.
- New 'google' config group (google_client_id/secret, encrypted) on the Configuration page; the
  token-refresh reads the creds the same way.
- Public GET /auth/config exposes google_enabled; the login page hides 'Continue with Google'
  when Google OAuth isn't configured (email+password still works).

backend/app/youtube/client.py

@@ -66,8 +66,8 @@ class YouTubeClient:
         resp = self._http.post(
             GOOGLE_TOKEN_URL,
             data={
-                "client_id": settings.google_client_id,
-                "client_secret": settings.google_client_secret,
+                "client_id": sysconfig.get_str(self.db, "google_client_id"),
+                "client_secret": sysconfig.get_str(self.db, "google_client_secret"),
                 "refresh_token": refresh,
                 "grant_type": "refresh_token",
             },