google sso verify code

Exchange a Google authorization code for user identity. Returns email, name, and a service token for "user exists by service". DEPRECATED from 15.0.1 for signing people in: it takes the client secret on a pin, so the secret sits in the blueprint, in every export of it and in every simulation trace; it reads the id_token without checking Google's signature, which is safe only because the token came straight from Google's token endpoint and wrong for one an app hands over; and "user exists by service" authenticates from a field any blueprint can write. Configure a "Sign in with Google" service provider instead and send the ID token to POST /auth/google: the core verifies it, creates the account on first use and answers with a session. Accounts it creates carry the same google-{id} service token, so existing flows still find them. Still works for flows that only need Google API access tokens.