fix(accounts): BYO-only OAuth + persist-then-consume finish rollback (R2-P2-1/P2-2)

R2-P2-1: remove the baked-in default Google OAuth client - resolve_creds now
requires a submitted BYO client id (or the env test-injection seam) and rejects
otherwise (auth.consent_required); start_oauth_signin + finish_add_account gate
on it. assembly's env-only resolver keeps the e2e seam without a production
default.

R2-P2-2: finish_add_account reads session tokens by clone (not take) and removes
the session only on full success, so a failed finish stays replayable. New
persist_new_account over an AccountSecretStore trait stores token -> creds -> row
with rollback of all keychain writes on any failure, so a forced row-insert
failure leaves no orphaned creds.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012CyiRqk2DVwmJjEu5gcD1m

Author: pmaxhogan