OAuth scopes

Stub: Sheets on install. Gmail send, Drive file/folder, and Docs when a recipe actually needs them.

Will (admin) should see incremental prompts, not every API on day one. Restricted Drive-wide and Gmail read-all are out of v1.

If a new scope ships later, users re-authorize that increment. They do not reinstall.