fix(auth): add missing profile scope for people/me verification

[rianjs]

What

Adds people.UserinfoProfileScope (https://www.googleapis.com/auth/userinfo.profile) to AllScopes and ScopeDescriptions in internal/auth/auth.go.

Why

gro init verifies each Google API after OAuth by making a live call. The People API verification calls people/me with PersonFields("names,emailAddresses") — this also powers gro me. Google requires the userinfo.profile scope for this endpoint; the contacts scope only grants access to the user's contacts list, not their own profile.

Without this fix, gro init always exits with a 403 on the People API verification step:

Error: verifying People API: googleapi: Error 403: The caller does not have permission
to request "people/me". Request requires one of the following scopes: [profile].

This makes fresh credential setup completely broken for anyone following the setup instructions.

Migration

Existing users with a stored token will need to re-authenticate after upgrading:

gro config clear && gro init

Closes #119

[rianjs]

Findings

• Blocker - CI guardrails still reject the new scope. internal/auth/auth.go:35 adds people.UserinfoProfileScope, but internal/auth/auth_test.go:104 still expects exactly 6 scopes, and internal/architecture/architecture_test.go:312 does not include https://www.googleapis.com/auth/userinfo.profile in allowedScopes. As written, the auth and architecture tests will fail. Update both test guardrails, and use that architecture allowlist entry to document why this profile scope is non-destructive/read-only.

Notes

The production scope choice looks correct. Google’s People API docs show people/me with personFields=names,emailAddresses, and the people.get reference lists https://www.googleapis.com/auth/userinfo.profile as an accepted private-data scope: https://developers.google.com/people/v1/profiles and https://developers.google.com/people/api/rest/v1/people/get

CheckScopesMigration should pick this up automatically because it iterates auth.AllScopes; no extra migration logic appears necessary. In this checkout, docs/google-cloud-setup.md already mentions the profile scope.