feat(mail): withhold new Gmail consents on hosted unless the company is allowlisted (#2320)

Every Gmail consent shows "Google hasn't verified this app" until the
restricted-scope review closes, and a prospect bounced on it today. Jakob's
call: remove the connector in the meantime rather than explain the screen.

New consents are gated by GOOGLE_MAIL_CONNECT_COMPANY_IDS on hosted: unset
means nobody (the default from this deploy on), `*` means everybody (set once
Google approves), a comma list means those companies (the reviewer's demo
company, the company the video is recorded in). Enforced in /oauth/start
(403 connect_disabled) and mirrored as connectEnabled on /connections, so the
settings page drops its connect button and the inbox start card falls back to
plain upload. Existing mailboxes stay listed, keep being searched and can be
disconnected. Self-hosted installs run their own Google app and are never
gated.


Claude-Session: https://claude.ai/code/session_01UD3HsDX8hnJEqpt35azxBJ

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

.env.example

@@ -32,6 +32,15 @@ RECEIPT_HUNT_MODEL_ID=
 RECEIPT_HUNT_MIN_CONFIDENCE=
 RECEIPT_HUNT_COMPANY_IDS=
 
+# Gmail connect gate (hosted only; self-hosted installs run their own Google
+# app and are never gated). Who may start a NEW Gmail consent: unset means
+# nobody (the default while Google's restricted-scope review is open, so
+# prospects never meet the "Google hasn't verified this app" screen), `*`
+# means everybody (set once the scope is approved), or a comma-separated list
+# of company ids (the reviewer's demo company). Existing connections keep
+# working either way.
+GOOGLE_MAIL_CONNECT_COMPANY_IDS=
+
 # Session timeouts are opt-in per user (user_preferences.auto_logout, toggled
 # in Settings > Security): users who have not opted in stay signed in for the
 # full Supabase session lifetime. The variables below set the limits that