[Connector Hub Phase 3] OAuth device-flow + Playwright connectors

[kovtcharov]

Parent: #735 (Connector Hub)

Phase 3 — Gmail, Google Calendar, Outlook via OAuth device-flow and Playwright browser automation.

Scope

Add OAuth-based connectors and Playwright-backed connectors for apps where browser login is the fastest path. Ships alongside #635 messaging adapters in v0.23.0.

Deliverables

Backend

• src/gaia/ui/connectors/oauth.py — device-flow helpers for Google and Microsoft
  • initiate_device_flow(provider) → {verification_url, user_code, expires_in}
  • poll_device_flow(provider) → saves tokens on success, handles expiry
  • Token refresh loop for long-lived sessions
• GET /api/connectors/oauth/{name}/device-init and GET /api/connectors/oauth/{name}/device-poll endpoints
• Playwright-backed connector support: Gmail and Google Calendar using shared browser context from Email and Calendar management via browser automation (Playwright) #660
• Catalog entries: Gmail (playwright phase 1 / oauth phase 2), Google Calendar, Outlook (Graph API, oauth device flow)
• "Needs attention" connection state for expired/revoked tokens with toast notification

Frontend

• DeviceFlowDialog.tsx — shows verification URL + user code + polling spinner
• Token expiry warning badge on connector cards
• "Reconnect" action for expired connectors

Validation

• Connect Gmail via Playwright: browser opens, user logs in, agent can read inbox
• Ask ChatAgent "summarize my unread from this week" — returns real email summaries
• Connect Google Calendar via OAuth device flow: enter code on google.com, auto-completes
• Token refresh works across agent restarts

Dependencies

• Hard: Phase 2 (vault + lifecycle infrastructure)
• Soft: Email and Calendar management via browser automation (Playwright) #660 (Playwright auth persistence — shared browser context)

Plan reference

docs/plans/connector-hub.mdx §9 Phase 3