- Replace service account authentication with OAuth 2.0 user flow
- Add "Authorize with Google" button in admin settings
- Handle OAuth callback and token exchange
- Store refresh token for automatic access token renewal
- Add revoke authorization functionality
- Update admin UI to show authorization status
- Update price updater to use new OAuth credentials
- Add CSRF protection with state parameter
This change supports organizations that have disabled service account
key creation via iam.disableServiceAccountKeyCreation policy.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
