fix(email): hide OAuth storage fields from config responses

[RaresKeY]

Summary

Remove encrypted Google OAuth access-token, refresh-token, and expiry storage fields from the browser-facing legacy email configuration response. The route still returns the provider status and ordinary account settings needed by the UI, matching the existing account-list response boundary.

The internal transport helper remains unchanged and can continue supplying OAuth fields to server-side IMAP/SMTP callers.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5639

Part of #5637

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — this response-serialization bug is not already tracked.
• This PR targets dev.
• My changes are limited to the client response boundary and focused regression coverage.
• I ran the app end-to-end. This backend serialization fix was validated with the live route function and adjacent email tests in an isolated environment with mocked provider/network I/O.

How to Test

1. Run:

   python -m pytest -q tests/test_email_oauth.py tests/test_email_owner_scope.py

2. Configure a Google email account and request GET /api/email/config.

3. Verify the response still contains oauth_provider: "google" but does not contain oauth_access_token, oauth_refresh_token, or oauth_token_expiry.

4. Verify password masking and ordinary email preferences are unchanged.

Current-dev isolated validation passes 146 adjacent tests. Python compilation and diff checks pass.

Visual / UI changes

N/A — backend response serialization and tests only; no UI rendering changed.

Screenshots / clips

N/A — no visual changes.

[o3LL]

Correct, minimal, and complete! Approved