fix(sync): auth and health UX improvements

Problem: Failed token exchange left credential files on disk, trapping
users in a broken auth loop with no way back to setup. The `auth`
prompt used raw backend names and a terse prompt string. The `health`
action appeared in `:Pending gcal health` tab completion but silently
no-oped outside `:checkhealth`. gcal health omitted the token check
that gtasks had.

Solution: `_exchange_code` now calls `_wipe()` on both failure paths,
clearing the token and credentials files so the next `:Pending auth`
routes back through `setup()`. Prompt uses full service names and
"Authenticate with:". `health` is filtered from sync subcommand
completion and dispatch — its home is `:checkhealth pending`. gcal
health now checks for tokens.

lua/pending/sync/gcal.lua

@@ -234,6 +234,12 @@ end
 ---@return nil
 function M.health()
   oauth.health(M.name)
+  local tokens = oauth.google_client:load_tokens()
+  if tokens and tokens.refresh_token then
+    vim.health.ok('gcal tokens found')
+  else
+    vim.health.info('no gcal tokens — run :Pending auth')
+  end
 end
 
 return M