feat(google-health): wire the OAuth routes, sync jobs, and source priority

Add the request surface and the background sync for the Google Health
provider, all built on the shared integration plumbing.

- Routes under /api/google-health: connect (mint the PKCE pair and state
  nonce, redirect to Google), callback (timing-safe CSRF, atomic state
  consume, token exchange, connection upsert, clear the reauth flag,
  enqueue backfill), credentials (encrypt the operator's BYO client id
  and secret field-by-field), disconnect, status, and a rate-limited
  manual sync.
- Jobs: a boot-time backfill, an hourly poll cohort, and a daily
  oauth-state cleanup, registered under the existing dead-queue contract.
- Rank GOOGLE_HEALTH just after Fitbit in the per-metric source ladders;
  it is the successor API for the same devices.
- Add GOOGLE_HEALTH to the readable measurement-source enum but leave it
  out of the writable set — the provider is server-owned, so a client
  cannot attribute a write to it.
- Register the two new encrypted token columns and the two BYO-client
  columns in the encryption-rotation registry and the rotation script.

scripts/rotate-encryption-key.ts

@@ -178,6 +178,8 @@ async function main() {
     "whoopClientSecretEncrypted",
     "fitbitClientIdEncrypted",
     "fitbitClientSecretEncrypted",
+    "googleHealthClientIdEncrypted",
+    "googleHealthClientSecretEncrypted",
     "nightscoutUrlEncrypted",
     "nightscoutTokenEncrypted",
     "polarAccessTokenEncrypted",
@@ -223,6 +225,13 @@ async function main() {
         prisma.fitbitConnection,
       ),
     );
+    results.push(
+      await rotateStringColumn(
+        "GoogleHealthConnection",
+        field,
+        prisma.googleHealthConnection,
+      ),
+    );
   }
 
   // ───── AppSettings — operator credentials (String) ─────