Decouple Gmail permissions from Google Sign-In OAuth flow

The Google Sign-In flow now only requests basic profile scopes (openid,
email, profile) instead of also requesting Gmail API scopes. Users can
grant Gmail access separately via the "Connect Gmail" button in Settings.

- Remove GMAIL_SCOPES from GOOGLE_LOGIN_SCOPES in auth.py
- Remove Gmail credential auto-provisioning from google_oauth endpoint
- Simplify /auth/google/authorize-url (no offline access or forced consent)
- Clean up auth_service.py OAuth registration to only use login scopes
- Remove unused imports (GmailCredential, GmailService, encrypt_credential, etc.)

Agent-Logs-Url: https://github.com/christianlouis/InboxConverge/sessions/91d2db11-811f-46f5-ac89-29952ab358b5

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

docs/TODO.md

@@ -207,7 +207,7 @@ Comprehensive task breakdown for repository improvements and production readines
 - [x] Per-user SMTP configuration (UX + backend)
 - [x] Gmail API one-click OAuth grant flow with token refresh and revocation handling
 - [x] Configurable Gmail import labels (default `{{source_email}}` + `imported`, editable in Settings with reset-to-default action)
-- [x] Unified Google OAuth flow: sign-in requests all Gmail scopes; single `/auth/callback` redirect URI needed in Google Console
+- [x] Decoupled Google Sign-In from Gmail API permissions: login now requests only basic profile scopes; Gmail access is granted separately via Settings
 - [x] Message deduplication (POP3 UIDL + IMAP \Seen flag + DB tracking)
 - [x] **Debug email**: "Send Debug Email" button in Settings injects a test message (from christian@docuelevate.org, dated today, labelled `test` + `imported`, placed in inbox) to verify end-to-end Gmail API delivery
 - [x] **Logging & reporting**: per-email ProcessingLog capture in worker; user `/logs` page; admin `/admin/logs` page; GDPR masking utilities (`gdpr.py`)