feat(sync): ship bundled OAuth credentials

Problem: Users must manually create a Google Cloud project and place a
credentials JSON file before sync works — terrible onboarding.

Solution: Add `client_id`/`client_secret` fields to `GcalConfig` and
`GtasksConfig`. `oauth.lua` resolves credentials in three tiers: config
fields, credentials file, then bundled defaults (placeholders for now).

lua/pending/config.lua

@@ -9,9 +9,13 @@
 ---@class pending.GcalConfig
 ---@field calendar? string
 ---@field credentials_path? string
+---@field client_id? string
+---@field client_secret? string
 
 ---@class pending.GtasksConfig
 ---@field credentials_path? string
+---@field client_id? string
+---@field client_secret? string
 
 ---@class pending.SyncConfig
 ---@field gcal? pending.GcalConfig