feat(sync): auto-discover backends, per-backend auth, S3 backend

Problem: sync backends were hardcoded in `SYNC_BACKENDS` list in
`init.lua`, auth routed directly through `oauth.google_client`, and
adding a non-OAuth backend required editing multiple files.

Solution: replace hardcoded list with `discover_backends()` that globs
`lua/pending/sync/*.lua` at runtime. Rewrite `M.auth()` to dispatch
to per-backend `auth()` methods with `vim.ui.select` fallback. Add
`lua/pending/sync/s3.lua` with push/pull/sync via AWS CLI, per-task
merge by `_s3_sync_id` (UUID), and `pending.S3Config` type.

spec/sync_spec.lua

@@ -110,5 +110,76 @@ describe('sync', function()
       local gcal = require('pending.sync.gcal')
       assert.are.equal('function', type(gcal.health))
     end)
+
+    it('has auth function', function()
+      local gcal = require('pending.sync.gcal')
+      assert.are.equal('function', type(gcal.auth))
+    end)
+
+    it('has auth_complete function', function()
+      local gcal = require('pending.sync.gcal')
+      local completions = gcal.auth_complete()
+      assert.is_true(vim.tbl_contains(completions, 'clear'))
+      assert.is_true(vim.tbl_contains(completions, 'reset'))
+    end)
+  end)
+
+  describe('auto-discovery', function()
+    it('discovers gcal and gtasks backends', function()
+      local backends = pending.sync_backends()
+      assert.is_true(vim.tbl_contains(backends, 'gcal'))
+      assert.is_true(vim.tbl_contains(backends, 'gtasks'))
+    end)
+
+    it('excludes modules without name field', function()
+      local set = pending.sync_backend_set()
+      assert.is_nil(set['oauth'])
+      assert.is_nil(set['util'])
+    end)
+
+    it('populates backend set correctly', function()
+      local set = pending.sync_backend_set()
+      assert.is_true(set['gcal'] == true)
+      assert.is_true(set['gtasks'] == true)
+    end)
+  end)
+
+  describe('auth dispatch', function()
+    it('routes auth to specific backend', function()
+      local called_with = nil
+      local gcal = require('pending.sync.gcal')
+      local orig_auth = gcal.auth
+      gcal.auth = function(args)
+        called_with = args or 'default'
+      end
+      pending.auth('gcal')
+      gcal.auth = orig_auth
+      assert.are.equal('default', called_with)
+    end)
+
+    it('routes auth with sub-action', function()
+      local called_with = nil
+      local gcal = require('pending.sync.gcal')
+      local orig_auth = gcal.auth
+      gcal.auth = function(args)
+        called_with = args
+      end
+      pending.auth('gcal clear')
+      gcal.auth = orig_auth
+      assert.are.equal('clear', called_with)
+    end)
+
+    it('errors on unknown backend', function()
+      local msg
+      local orig = vim.notify
+      vim.notify = function(m, level)
+        if level == vim.log.levels.ERROR then
+          msg = m
+        end
+      end
+      pending.auth('nonexistent')
+      vim.notify = orig
+      assert.truthy(msg and msg:find('No auth method'))
+    end)
   end)
 end)