feat(auth): 服务端托管 Google OAuth；修复未解锁 vault 时 bootstrap

- API：桌面登录 session、Google 托管回调与轮询
- Desktop：轮询登录；bootstrap 在 vault 未解锁时不返回 shell，避免跳过主密码
- 文档与 deploy/.env.example 对齐 GOOGLE_OAUTH_* 与 SECRETS_PUBLIC_BASE_URL

apps/api/Cargo.toml

@@ -20,6 +20,9 @@ tracing-subscriber.workspace = true
 uuid.workspace = true
 chrono.workspace = true
 reqwest.workspace = true
+sha2.workspace = true
+url.workspace = true
+base64 = "0.22.1"
 
 secrets-application = { path = "../../crates/application" }
 secrets-device-auth = { path = "../../crates/device-auth" }