fix google oauth token routing - #457

fixes #307

changes

• share the oauth2.googleapis.com/token intercept rule across Google OAuth app providers
• keep the token endpoint as an intercept target instead of routing all refreshes through Vertex AI
• add regression coverage for Google Calendar and shared Google OAuth token routing

verification

• cargo fmt --manifest-path apps/gateway/Cargo.toml --check
• cargo test --manifest-path apps/gateway/Cargo.toml google_calendar_produces_token_intercept_rule
• cargo test --manifest-path apps/gateway/Cargo.toml oauth2_token_endpoint_maps_to_google_oauth_apps
• cargo test --manifest-path apps/gateway/Cargo.toml oauth2
• cargo test --manifest-path apps/gateway/Cargo.toml intercept_token_comes_from_app_rules_only
• pnpm check
• pnpm build
• git diff --check