fix(auth): request Google's account chooser on legacy login

[jiashuoz]

Summary

• User-visible problem: Because no prompt parameter was sent in the legacy Google OAuth login handler (HandleLogin), Google would silently re-authenticate a browser session that has a single signed-in Google account which had already consented. A user who signed out and clicked "Sign in with Google" was logged straight back in without being able to choose another account.
• Fix: Pass oauth2.SetAuthURLParam("prompt", "select_account") to ua.oauthConfig.AuthCodeURL(...) in internal/auth/auth.go.
• Trade-off: Single-account users see Google's account selection prompt on login, requiring one extra click to confirm their account.
• Contract & scope: Scopes, access_type, state encoding, and the OIDC (TokenCanopy) login path remain completely unchanged. This touches only the legacy /api/auth/login route; no /v1 endpoints, OpenAPI spec, or SDK regeneration are involved.

Validation Commands and Results

make fmt-check

(clean, exit 0)

make build

go build -o bin/e2a ./cmd/e2a

go vet ./internal/auth/...

(clean, exit 0)

make test-unit

go test -short ./internal/outbound/ ./internal/relay/ ./internal/config/ ./internal/webhook/ ./internal/approvaltoken/ ./internal/unsubscribe/ ./internal/limits/ ./internal/httpapi/ ./internal/ratelimit/
ok  	github.com/tokencanopy/e2a/internal/outbound	0.807s
...
--- FAIL: TestInboundActivityRecording_AuthenticatedMailUpdatesCounters (1.61s)
    inbound_activity_test.go:95: inbound_count = 0, want 1
...
FAIL	github.com/tokencanopy/e2a/internal/relay	12.698s
ok  	github.com/tokencanopy/e2a/internal/config	0.471s
ok  	github.com/tokencanopy/e2a/internal/webhook	8.102s
ok  	github.com/tokencanopy/e2a/internal/approvaltoken	0.118s
ok  	github.com/tokencanopy/e2a/internal/unsubscribe	0.442s
ok  	github.com/tokencanopy/e2a/internal/limits	0.344s
ok  	github.com/tokencanopy/e2a/internal/httpapi	7.252s
ok  	github.com/tokencanopy/e2a/internal/ratelimit	3.213s
FAIL
make: *** [test-unit] Error 1

Note on pre-existing test failure: make test-unit encounters a failure in github.com/tokencanopy/e2a/internal/relay (TestInboundActivityRecording_AuthenticatedMailUpdatesCounters in inbound_activity_test.go:95: inbound_count = 0, want 1). This failure is pre-existing and reproducible on clean main.

All tests in github.com/tokencanopy/e2a/internal/auth pass:

$ go test ./internal/auth/...
ok  	github.com/tokencanopy/e2a/internal/auth	31.711s

Prepared by a pi agent (gemini-3.8-flash), reviewed before merge.

[jiashuoz]

Independent review (Claude, on top of the pi/Gemini run) — verified rather than trusted:

• Diff: exactly the intended change — prompt=select_account added via oauth2.SetAuthURLParam in HandleLogin, scopes/state/OIDC path untouched, legacy /api/auth/login only (no /v1, no spec/SDK impact), plus one focused test.
• The new test was not exercised by make test-unit (that target's package list omits internal/auth), so I ran it explicitly: go test -short -count=1 ./internal/auth/ -run TestHandleLogin_RequestsGoogleAccountChooser → PASS; the whole internal/auth package in short mode → ok (33s).
• Gates re-run locally on this branch: make fmt-check PASS · make build PASS · go vet ./internal/auth/... PASS · make test-unit PASS (9 packages).
• The internal/relay failure the PR body reports (TestInboundActivityRecording_AuthenticatedMailUpdatesCounters) reproduces on origin/main in isolation on this machine and did not reproduce in my make test-unit run — flaky/environment-dependent and unrelated to this diff. CI is authoritative for it.
• Behavioural note for reviewers: after this ships, every legacy Google sign-in shows Google's account chooser (one extra click for single-account users) — the intended trade-off after an explicit sign-out. Ships with the next server release (tag → staging pipeline → promote), not by merge alone.

Approve from my side; merge remains user-gated (OSS branch protection → admin-override merge once CI is green).