feat(web): manage Google Group binding on the group edit page

[BK1031]

Frontend for the Sentinel-group → Google-Group sync. Adds a "Google Group sync" card to the group edit page.

What's here

• web/src/lib/google.ts: GroupGoogleBinding type + useGroupGoogleBinding(groupID) query hook (returns the single 1:1 binding or null)
• GoogleSyncCard on GroupEditPage: one email field for the mapped Google Group, plus a Sync now button (POST /google/reconcile)
• The email is staged like the rest of the page — applied on Save changes by diffing against the server binding (clear/replace deletes the old row, a non-empty value upserts)
• Cache invalidation + a loading-gate entry for the new query

Design notes

• Not gated on allowed_sources — Google is an outbound projection, not a membership source, so the card always shows (unlike the Discord/Conditional cards which gate on their source).
• 1:1 mapping → a single field rather than the Discord-style multi-binding list.
• The init-from-query effect matches the existing appLinkState/values pattern in this file.

Verification

• tsc -b + vite build (the web image's build) pass.
• eslint: adds one react-hooks/set-state-in-effect consistent with the 2 pre-existing instances in this file; not a CI gate (web.yml builds via tsc/vite only).

Dependency

Functionally needs the gateway route /api/google/* (PR #92, local kerbecs.yaml) and the prod kerbecs config (PR 4, infra) to actually reach the service. The Sync now button uses /google/reconcile from #92.