feat(gmail,update): finish the OAuth2 flow, and tell admins about new releases

Gmail now connects. Authorisation-code flow with PKCE, the verifier kept
server-side rather than in a cookie — the callback is a top-level
navigation from Google, and a SameSite=Lax cookie is the kind of thing
that works until a browser tightens its defaults. State is checked, the
attempt expires after ten minutes, and the spent verifier is deleted
rather than left at rest.

Scope is gmail.readonly and the sync is one-way on purpose. Unstarring a
message does not delete the task; completing the task does not touch the
mailbox. Two-way would mean deciding what happens when both sides
changed, and the only honest answer is a sync model far larger than the
feature. The query carries newer_than:30d so connecting an account with
a decade of starred mail does not create a decade of tasks.

The update check is off unless the operator turns it on, asks GitHub at
most every six hours, and sends nothing about the instance — no
identifier, no version, no counts. A development build never reports an
update: somebody running their own tree is ahead of every release, and
telling them otherwise trains them to ignore the notice. Only
administrators see it, because only they can act on it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/jobs/jobs.go

@@ -31,6 +31,12 @@ type Runner struct {
 	mail *mail.Sender
 	hub  *realtime.Hub
 
+	// SyncGmail is supplied by the HTTP layer, which owns the token refresh and
+	// the task creation. Passed in as a function rather than importing it, because
+	// the other direction would be a cycle: httpapi already depends on jobs being
+	// startable from main.
+	SyncGmail func(ctx context.Context, user *store.User) (int, error)
+
 	wg sync.WaitGroup
 }
 
@@ -49,6 +55,11 @@ func (r *Runner) Start(ctx context.Context) {
 	r.every(ctx, "backup", time.Hour, r.nightlyBackup)
 	r.every(ctx, "trash", time.Hour, r.emptyTrash)
 	r.every(ctx, "sessions", 6*time.Hour, r.purgeSessions)
+	// Ten minutes is a compromise: Gmail's push notifications would be instant but
+	// need a public webhook and a Cloud Pub/Sub topic, which is a lot of Google
+	// account for a to-do app. Ten minutes is fast enough for something somebody
+	// starred and slow enough not to look like abuse.
+	r.every(ctx, "gmail", 10*time.Minute, r.syncGmailAccounts)
 }
 
 func (r *Runner) Wait() { r.wg.Wait() }
@@ -214,6 +225,33 @@ func (r *Runner) rotateBackups() error {
 	return nil
 }
 
+// --- gmail ---------------------------------------------------------------------------
+
+// syncGmailAccounts polls every connected mailbox.
+//
+// One at a time, and a failure on one account does not stop the others: a revoked
+// token or an expired refresh is a problem for that person alone.
+func (r *Runner) syncGmailAccounts(ctx context.Context) error {
+	if r.SyncGmail == nil {
+		return nil
+	}
+	users, err := r.db.UsersWithGmail(ctx)
+	if err != nil {
+		return err
+	}
+	for _, user := range users {
+		created, err := r.SyncGmail(ctx, &user)
+		if err != nil {
+			r.log.Warn("gmail sync", "err", err, "user", user.ID)
+			continue
+		}
+		if created > 0 {
+			r.log.Info("tasks created from gmail", "user", user.ID, "count", created)
+		}
+	}
+	return nil
+}
+
 // --- housekeeping -----------------------------------------------------------------
 
 func (r *Runner) emptyTrash(ctx context.Context) error {