Add split OAuth flow for agents

[PiotrCzapla]

Summary

• Add auth_url and finish_auth so agents can pause while a user completes OAuth.
• Accept and validate the compact code=...&state=... result from oauth.appapis.org.
• Allow preset=None when callers need an exact scope set.
• Keep authorize_google and the CLI flow on the same exchange and token-saving code.

Tests

• pytest -q -p no:cacheprovider (8 passed)