Recover Google Messages auth without re-pairing

[Phloraxx]

Problem

The live Google-account/libgm session can remain phone-paired while Google's browser/session authentication becomes invalid. In production this presented as SESSION_COOKIE_INVALID / HTTP 401. The previous manager treated every fatal poll error as reconnectable, causing a roughly 2-second reconnect loop and misleading lastConnectedAt updates because libgm.Connect() returns before its asynchronous long poll is actually ready.

Fix

• preserve the existing Google phone/crypto pairing on Google auth failures;
• enter explicit reauth_required instead of reconnecting indefinitely on Google 401/403 / invalid credentials;
• add dashboard-only POST /api/connector/gmessages/reauth/google;
• accept the same filtered Copy-as-cURL/Cookie/JSON input used for initial Gaia pairing;
• verify fresh cookies against Google config and require the same previously paired account before persisting;
• keep fresh credentials out of responses/logs;
• reconnect with the existing pairing after successful re-auth;
• stop marking the connector connected merely because async libgm.Connect() returned nil;
• add a Settings UI recovery panel that explains no emoji/re-pair is required;
• add auth/state/session-clone regression tests.

Final validation

Exact head: 4fe85c522d43d2e91486bcd56f170fe2b3157f60

• temporary self-writing PR workflow removed before merge; final diff contains application/test/UI files only;
• GitHub CI run #74 passed on the exact head;
• fresh-clone frontend npm ci, npm audit --audit-level=high, typecheck and production build passed;
• gofmt/git diff --check, full uncached Go suite, race detector and go vet passed;
• staticcheck passed;
• govulncheck found no reachable vulnerabilities;
• clean production Docker image builds as nonroot:nonroot;
• isolated second-pass Codex review inspected the diff and reported no actionable regressions, including the same-pairing reauth path and stale-client event handling.

No real SMS bodies, Google cookies, pairing tokens, or session contents are included in this PR.