fix(google): tell a stale grant to reconnect instead of calling it an upstream error

[fajarhide]

A Google grant issued before a scope widened got upstream_error on the tools it now lacks, and nothing in that answer said to reconnect. gdrive has been in that state since #35; #84 put gmail and gcal there too, so it is live on main for every existing Google connection right now.

Google spends 403 on two unrelated things: a scope the grant never got, and an API that was never enabled. errors.forbidden mapped both to upstream_error, which is right for the second and a dead end for the first. bodyFailure already runs ahead of the 403 arm (manifest.ts:610), so the reason inside the error body separates them with no executor change. SERVICE_DISABLED is not in codes, so it keeps falling through to upstream_error, and a 401 reports UNAUTHENTICATED in error.status so bodyFailure never fires on it.

Closes #88

Evidence

Three tests, run across all three google prefixes: the missing scope becomes reauth_required, the disabled API stays upstream_error, and a 401 is still handled by the arm that already had it.

Broken deliberately, codes emptied on gmail:

 × tells a caller to reconnect when the grant is missing the scope
   → gmail: expected 'upstream_error' to be 'reauth_required'
   Tests  1 failed | 42 passed (43)

Restored, full suite:

 Test Files  42 passed (42)
      Tests  445 passed (445)

Not verified

insufficientPermissions is the reason string from Google's documented error shape, not one observed on a live 403. The tests prove the wiring, not the string. Whoever runs the first real reconnect should check it against an actual refusal, because if the string is wrong this silently keeps the old behaviour rather than failing loudly.