Returns the Google OAuth URL as JSON so the frontend can `window.open` it
after the auth-protected request completes. Browsers don't include our
Bearer header on plain navigations, so we can't 302 from this endpoint —
the URL has the userId baked into the