Use ASWebAuthenticationSession for Google OAuth

[shiny-code-bot]

Summary

• replace Google Antigravity OAuth's localhost NWListener callback server with ASWebAuthenticationSession
• register the Google OAuth custom callback scheme and route fallback callback URLs back into Settings
• remove com.apple.security.network.server from the main app entitlements and update packaging/runtime gates to require it absent
• update OAuth and entitlement tests for the custom-scheme redirect

Operational note

The Google OAuth client used in release builds must allow this native redirect URI before Google reconnect/setup can succeed:

com.shinycomputers.contextpanel:/oauth-callback

Existing stored refresh tokens should continue to work; this affects new Google setup/reconnect flows.

Validation

• swift test
• scripts/commit-gate.sh
• read-only GPT review found a fallback-routing issue; fixed by routing incoming OAuth callback URLs into Settings
• read-only Claude review attempt returned no actionable review output