v3.4.142

Fix silent failure when stored Google account data can't be decrypted (e.g. after an AUTH_KEY rotation or corrupted option). Previously every read path saw an empty accounts array, indistinguishable from "no account connected", so grants and revokes stalled forever with no visible cause. Added an admin notice that surfaces this condition explicitly.

Also hardened the concurrent-refresh race check in refresh_access_token(): it only compared the persisted refresh_token to detect a winning concurrent refresh, which could miss the case where that refresh succeeded with Google but hadn't finished its lock-protected write yet. Now checks the cached access-token transient first.