Fix Google OAuth native callback flow

[shiny-code-bot]

Summary

• switch Google sign-in from the app bundle URL scheme to the Google native installed-app callback scheme
• make Google OAuth client secrets optional for native clients while preserving legacy client metadata for existing refresh tokens
• inject and validate the derived callback scheme across local install, packaging, and App Store upload paths

Validation

• swift test
• python3 -m unittest Tests/ScriptsTests/test_release_workflows.py
• scripts/commit-gate.sh
• JetBrains changed-files closeout: clean, 0 problems

Notes

• Existing legacy Google refresh tokens can keep using the old configured legacy client ID/secret.
• New sign-ins require a Google Apple/iOS installed-app OAuth client ID so Google accepts the custom scheme redirect.