Add Google One Tap sign-in to homepage

[bellisabell]

Adds Google One Tap authentication to the marketing homepage for frictionless sign-up.

What it does

• Shows a Google One Tap prompt for users already signed into Google
• One-click sign-up or sign-in
• Only shows in multiuser mode when Google OAuth is configured
• Only shows for logged-out users

Changes

• Added google-id-token gem for JWT verification
• Created GoogleOneTapController to handle the callback
• Added route POST /auth/google_one_tap/callback
• Added One Tap partial to homepage

Notes

• Uses the same Google OAuth client ID already configured
• One Tap has built-in rate limiting (exponential cooldown if dismissed)
• Works alongside existing "Sign up with Google" button on registration page

[philipithomas]

Closing this untested implementation after a fresh review against current main. The callback disables Rails CSRF without validating Google's double-submit CSRF token, returns existing accounts directly (bypassing the current OAuth restriction on administrator accounts), and signs in without checking active/locked state. The callback route also remains available outside multiuser mode. Existing Google OAuth remains the supported signup flow. A future One Tap implementation should share account policy and include CSRF, token, locked/admin-account, and mode regression tests.