feat(sync): unify Google auth under :Pending auth

Problem: users had to run `:Pending gtasks auth` and `:Pending gcal
auth` separately, producing two token files and two browser consents
for the same Google account.

Solution: introduce `oauth.google_client` with combined tasks +
calendar scopes and a single `google_tokens.json`. Remove per-backend
`auth`/`setup` from `gcal` and `gtasks`; add top-level `:Pending auth`
that prompts with `vim.ui.select` and delegates to the shared client's
`setup()` or `auth()` based on credential availability.

lua/pending/sync/gcal.lua

@@ -7,14 +7,6 @@ local M = {}
 M.name = 'gcal'
 
 local BASE_URL = 'https://www.googleapis.com/calendar/v3'
-local SCOPE = 'https://www.googleapis.com/auth/calendar'
-
-local client = oauth.new({
-  name = 'gcal',
-  scope = SCOPE,
-  port = 18392,
-  config_key = 'gcal',
-})
 
 ---@param access_token string
 ---@return table<string, string>? name_to_id
@@ -139,15 +131,15 @@ end
 ---@param callback fun(access_token: string): nil
 local function with_token(callback)
   oauth.async(function()
-    local token = client:get_access_token()
+    local token = oauth.google_client:get_access_token()
     if not token then
-      client:auth(function()
+      oauth.google_client:auth(function()
         oauth.async(function()
-          local fresh = client:get_access_token()
+          local fresh = oauth.google_client:get_access_token()
           if fresh then
             callback(fresh)
           else
-            log.error(client.name .. ': authorization failed or was cancelled')
+            log.error(oauth.google_client.name .. ': authorization failed or was cancelled')
           end
         end)
       end)
@@ -157,14 +149,6 @@ local function with_token(callback)
   end)
 end
 
-function M.setup()
-  client:setup()
-end
-
-function M.auth()
-  client:auth()
-end
-
 function M.push()
   with_token(function(access_token)
     local calendars, cal_err = get_all_calendars(access_token)