feat(connect): ship registered M365 + Google OAuth apps (#141)

[pawellisowski]

Summary

Ships first-party OAuth client IDs so aware connect microsoft-365 --device-code and aware connect google-workspace --oauth work with zero user setup — closes #141.

• M365 — multi-tenant public client (00929383-…). PKCE + device-code, no secret. 10 delegated Graph scopes covering the curated command surface (files/Excel, SharePoint lists, mail, calendar, Teams, Planner).
• Google — "Desktop app" client. Client ID committed (public); the client secret is never committed — baked at release-build via option_env!("AWARE_GOOGLE_CLIENT_SECRET") (CI secret) or supplied at runtime via AWARE_OAUTH_GOOGLE_CLIENT_SECRET. Scopes cover Drive/Sheets/Calendar/Gmail/Slides/Forms/Tasks.
• client_secret threaded through the PKCE, refresh, and device-code token exchanges — appended only when present, so the M365 public-client flow is unaffected.
• cli/build.rs adds rerun-if-env-changed so releases re-bake the secret.
• release.yml injects the secret into the cargo build --release step from a GitHub Actions secret.
• 10-core/oauth-registration.md documents registration, admin consent, and the Google restricted-scope / M365 publisher-verification gates.

Security

• No secret value in the diff (verified). Only public client IDs are committed.
• Google desktop-client secret is non-confidential by Google's native-app model but kept out of source to avoid quota abuse + secret scanners.

Test plan

• cargo build clean
• auth unit tests pass (incl. new client-secret invariant test)
• clippy clean on changed files
• reviewed (local reviewer; Codex unavailable on Windows sandbox)
• tagged release builds with the secret baked in (CI)
• aware connect microsoft-365 --device-code end-to-end (own tenant)
• aware connect google-workspace --oauth end-to-end (test user)

Follow-ups (not blocking)

• M365 publisher verification (cross-tenant) — in progress in Partner Center.
• Google production/CASA decision for restricted scopes (currently Testing mode).