fix(auth): inject Google OAuth credentials at build time

[mfauzaan]

Summary

Removes the hardcoded Google OAuth client ID and client secret from cli/src/auth/google_cloud.rs and injects them at compile time from GitHub Actions secrets, following the same pattern already used for WUKONG_HONEYCOMB_API_KEY in the telemetry crate.

• Prod builds (--features prod): credentials come from env!("WUKONG_GOOGLE_CLIENT_ID") / env!("WUKONG_GOOGLE_CLIENT_SECRET") — the build fails at compile time if the secrets are missing, so a release can never ship without credentials.
• Dev builds: fall back to empty strings via option_env!, so local cargo build / cargo test and contributor builds work without any secrets (set the env vars locally to test the Google login flow).
• Both ci.yml and release.yml inject the secrets at the workflow env: level (CI's build job also compiles with --features prod).

Required before merge / next release

1. Add WUKONG_GOOGLE_CLIENT_ID and WUKONG_GOOGLE_CLIENT_SECRET as Actions secrets in repo settings — prod builds fail without them.
2. Rotate the credentials in GCP Console — the old values are in the public git history, so removing them from HEAD is not enough. Put the new values in the Actions secrets.
3. Note for release notes: after rotation, Google login on older installed versions will fail (invalid_client) until users brew upgrade wukong.

Notes

• The client secret is still embedded in the released binary (inherent to any distributed CLI; Google treats installed-app client secrets as non-confidential per RFC 8252). The win here is keeping it out of source and git history so secret scanners stop flagging it.

Testing

• cargo check (dev, no env vars) ✅
• cargo check --features prod with env vars set ✅
• cargo fmt + cargo clippy — clean (2 pre-existing warnings unrelated to this change)
• cargo test — one pre-existing snapshot failure (application test, local-environment DNS issue) that also fails on unmodified main; all other tests pass

🤖 Generated with Claude Code