Sprint 5R: Gmail refresh-token rotation handling

[samrusani]

Summary

• persist provider-rotated Gmail refresh tokens inside the protected credential seam
• keep Gmail account reads secret-free and preserve the existing single-message ingestion path
• add unit and integration coverage for stable renewal, rotated renewal, and deterministic persistence failure

Verification

• ./.venv/bin/python -m pytest tests/unit
• ./.venv/bin/python -m pytest tests/integration