Polishes the local Google connection flow.
- Replaces the raw OAuth callback page with responsive branded success and error states.
- Clarifies saved Google setup and local credential handling in onboarding.
- Preserves a strict local-first, read-only OAuth flow.