Add Google Fit read-only integration - #446

Summary

Adds Google Fit as a read-only OAuth app integration.

What changed

• Registers Google Fit OAuth with the activity-read scope.
• Adds read permissions for data sources, datasets, aggregate data, and sessions.
• Adds gateway injection rules for www.googleapis.com and fitness.googleapis.com.
• Adds the generated gateway policy catalog entry.
• Adds the official Google Fit icon.
• Fixes NanoClaw/OneCLI requests that previously failed with “no matching provider” or default-deny policy errors.

Closes #442.

Validation

• API lint passed before the gateway additions.
• Gateway formatting and catalog JSON validation passed.
• Production Docker image built successfully.
• End-to-end Google Fit request from the running NanoClaw container returned HTTP 200 with data on both Google Fit API hosts.
• Existing OneCLI data volumes were preserved.

The full repository type-check is currently blocked by pre-existing Prisma-generated type errors.