feat(connectors): clean-install bundling + Google OAuth foundation

Make connectors work on a clean Mac with no Node/npm installed, and lay
the foundation for one-click Google sign-in.

Clean-install bundling:
- bundle scripts: `npm run bundle` -> self-contained dist/connectd.cjs (CJS,
  no node_modules); `bundle:servers` -> pre-bundled MCP servers (fs-server.mjs
  for "Your files", runs without npx); `bundle:all`.
- runtime resolution in the bridge: a connector config can use command "@node"
  (the bundled runtime, process.execPath) and arg "@bundled/<server>" (a server
  shipped alongside the bridge), resolved at spawn time via
  NEURON_CONNECTD_BUNDLE_DIR. So remote connectors + "Your files" work offline,
  zero deps.
- graceful ENOENT -> needs_setup ("coming soon") instead of a cryptic spawn
  crash for not-yet-bundled npx connectors on a clean machine.

Google OAuth foundation (google-oauth.ts):
- desktop-style authorization-code + PKCE flow, refresh, Keychain storage,
  gated on GOOGLE_OAUTH_CLIENT_ID (honest needs_setup until configured).
- new auth mode "google" for stdio connectors + /google/oauth/start and
  /google/callback endpoints. NOTE: pending the Neuron Google OAuth client +
  Google verification; not certified end-to-end yet.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/config.ts

@@ -13,8 +13,13 @@ export interface ServerConfig {
   env?: Record<string, string>;
   // http (Phase 3)
   url?: string;
-  auth?: "none" | "oauth" | "token";
+  auth?: "none" | "oauth" | "token" | "google";
   scope?: string; // OAuth scope string, when auth === "oauth"
+  // Google connectors (Drive/Gmail/Calendar): stdio servers whose Google OAuth the bridge
+  // performs itself (one-click), storing tokens in the Keychain. `scopes` = the Google API
+  // scopes to request. Requires a Neuron-owned Google OAuth client (GOOGLE_OAUTH_CLIENT_ID);
+  // until that's configured the connector reports needs_setup instead of failing cryptically.
+  scopes?: string[];
   // Phase 5: per-connector opt-in to skip the soul's approval card (read-only-leaning,
   // off by default). The soul reads this from connectors.json at approval time.
   autoApprove?: boolean;