fix(email): verify mailbox identity on OAuth reconnect

[RaresKeY]

Summary

Keep Google OAuth reconnects bound to the mailbox already configured on the saved account. The callback now requires a verified user-info email, compares it case-insensitively with every populated IMAP/SMTP login, and refuses to replace credentials when the identities differ.

A successful reconnect also requires and replaces both the access token and the offline refresh token as one pair. Existing tokens remain untouched when identity verification fails or Google omits a fresh refresh token.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5638

Part of #5637

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — adjacent OAuth work exists, but none owns this reconnect identity contract.
• This PR targets dev.
• My changes are limited to callback identity/credential replacement and focused regressions.
• I ran the app end-to-end. No disposable Google account was available; route-level and adjacent email tests were run in an isolated environment with mocked provider/network I/O instead.

How to Test

1. Run the OAuth and adjacent email suites:

   python -m pytest -q tests/test_email_oauth.py tests/test_email_owner_scope.py tests/test_email_imap_timeout.py tests/test_email_smtp_security.py tests/test_imap_leak_fixes.py

2. Reconnect a saved Google account with the same mailbox and verify the callback succeeds and replaces both credentials.

3. Attempt to reconnect it with a different Google identity and verify the callback reports identity verification failure without changing the saved credentials.

4. Return an access token without a fresh refresh token and verify the existing credential pair remains unchanged.

Current-dev isolated validation passes 150 adjacent tests. Python compilation and diff checks pass. Live Google validation remains a reviewer item.

Visual / UI changes

N/A — callback validation and tests only; no UI rendering changed.

Screenshots / clips

N/A — no visual changes.

[o3LL]

LGTM, I would suggest adding a new test but it could be done later, PR is in a good state already.

The identity gate now also runs on first-time connects. For a fresh account with empty imap_user/smtp_user, configured_logins is empty, so the gate reduces to "userinfo email must be present" and auto-fill proceeds correct. But no test covers this path: the test helper _make_account defaults both logins to test@example.com, so every callback test exercises a populated row. If someone later tightens any(login != verified_email ...) into a positive match requirement, first-connect breaks with no test catching it. One test with fresh account, successful userinfo, assert tokens stored and imap_user/smtp_user auto-filled would lock in the empty-set semantics.