[connectors] Phase 2: generic OAuth2 handler (manifest-driven authorize/callback/refresh)

[serge-ivo]

Fold the hand-rolled Drive/Gmail/GitHub OAuth flows into one manifest-driven handler keyed by connector id (authorize + callback + refresh from auth config; refresh token envelope-encrypted; secretRef resolved server-side). Unlocks Slack/Sheets/Notion as manifests-only. Part of #143.