Handle Google offline OAuth refresh parameters

[todor-roi]

Summary

• detect Google authorization endpoints in the final browser authorization URL
• request Google refresh tokens with access_type=offline and prompt=consent
• remove OIDC offline_access from the Google scope string to avoid invalid_scope

Reproduction

A clean local profile using Google OAuth with a scope string containing offline_access sends that scope through to Google. Google rejects the browser authorization request with invalid_scope, so no authorization code exchange completes and no refresh token can be persisted.

Fix

Google uses the authorization URL query parameter access_type=offline for refresh-token issuance. This keeps existing behavior for non-Google issuers while translating the Google case to access_type=offline&prompt=consent and stripping offline_access from the scope parameter.

Google's OAuth documentation notes that a refresh token is returned only when the initial authorization request sets access_type=offline: https://developers.google.com/identity/protocols/oauth2/web-server#offline

Tests

• corepack pnpm exec prettier --check src/lib/node-oauth-client-provider.ts src/lib/node-oauth-client-provider.test.ts
• corepack pnpm test:unit -- src/lib/node-oauth-client-provider.test.ts
• corepack pnpm exec tsc

Note: corepack pnpm check still fails on repo-wide pre-existing Prettier findings in untouched files on this Windows checkout.