fix(oauth): full callback URL, Google clientId, refresh, and review follow-ups

- Pass full OAuth callback URL through auth-server for openid-client validation
- Composio + Google flows: duplicate-callback guard; preserve timeout cleanup
- Persist and expose Google clientId via oauth:getState; hydrate UI from useConnectors
- getAccessToken returns refreshed credentials; clearer errors and missing-state handling
- IPC schema: per-provider userId + clientId
- Docs: google-setup redirect URI and troubleshooting

Made-with: Cursor

apps/x/packages/core/src/auth/repo.ts

@@ -18,6 +18,7 @@ const OAuthConfigSchema = z.object({
 const ClientFacingConfigSchema = z.record(z.string(), z.object({
   connected: z.boolean(),
   error: z.string().nullable().optional(),
+  clientId: z.string().nullable().optional(),
 }));
 
 const LegacyOauthConfigSchema = z.record(z.string(), OAuthTokens);
@@ -111,8 +112,9 @@ export class FSOAuthRepo implements IOAuthRepo {
       clientFacingConfig[provider] = {
         connected: !!providerConfig.tokens,
         error: providerConfig.error,
+        clientId: providerConfig.clientId ?? null,
       };
     }
-    return clientFacingConfig;
+    return ClientFacingConfigSchema.parse(clientFacingConfig);
   } 
 }