[codex] remove ngrok tunnel support

[Uarmagan]

Closes #1659

Why this change exists

Compass used to start an ngrok tunnel from inside the backend process. That made local Google Calendar watch testing convenient, but it also meant the app had a built-in dependency on a third-party tunnel service just to boot the backend in some environments.

This PR removes that built-in ngrok behavior and makes Google support optional. The goal is to let Compass run cleanly in password-only/self-hosted/local setups, while keeping Google sign-in and Google Calendar sync available when the right Google credentials are provided.

A follow-up PR will cover the new local end-to-end Google Calendar Watch workflow using an explicit developer-run tunnel, such as Cloudflare Tunnel. This PR intentionally does not replace ngrok with another automatic tunnel.

What changed

Backend startup no longer manages ngrok

• Removed the ngrok server wrapper and shutdown handling from backend startup.
• Removed the ngrok package dependency from the backend package.
• Removed NGROK_AUTHTOKEN / NGROK_DOMAIN from required or recognized backend environment config.

Google config is now optional

• GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET can now be left unset.
• If one Google credential is provided without the other, backend startup fails with a clear config error.
• TOKEN_GCAL_NOTIFICATION is only required when Google is configured and the backend BASEURL is HTTPS, because that is the mode where Google Calendar webhook notifications can actually be enabled.

The web app asks the backend whether Google is available

• Added /api/config, which tells the frontend whether backend Google support is configured.
• The frontend now hides Google sign-in / Google Calendar connection actions unless both sides are configured:
  • the web build has a Google client ID, and
  • the backend reports Google as configured.
• This avoids showing users Google buttons that cannot work in password-only or incomplete self-hosted setups.

Auth and UI handling were adjusted for password-only mode

• Google connection flows now surface a clearer “Google is not configured” failure when attempted against a backend without Google credentials.
• Header/sidebar Google status UI is disabled when Google is unavailable.
• Command palette Google Calendar actions are omitted when Google is unavailable.

Docs and examples were updated

• Local development docs now describe Google as optional.
• Self-hosting docs now explain password-only mode and when Google credentials are needed.
• The backend env example no longer asks for ngrok settings and clarifies that local HTTP can support Google sign-in/import, but not live Google-to-Compass watch notifications.

Important behavior note

After this PR, Compass will not automatically create a public HTTPS tunnel during local backend startup.

That means:

• Google sign-in can still work locally when OAuth redirect URLs are configured correctly.
• Initial Google Calendar import can still work locally when Google credentials are configured.
• Live Google Calendar Watch notifications require a public HTTPS backend URL and will be skipped when BASEURL is local HTTP.

This is expected. The replacement local testing workflow is handled separately so the tunnel is explicit, developer-controlled, and not tied to backend startup.

Test plan

• bun run test:backend
• bun run test:web
• bun run lint

All three completed successfully. Lint still reports the repo's existing warnings, but exits successfully.