feat: Google Drive agency sync with auto folder match

Connect marketing@ once, match Drive folders to tenants by name,
list Drive in Activos, and mirror portal uploads to the linked folder.

Co-authored-by: Cursor <cursoragent@cursor.com>

sql/google_drive.sql

@@ -0,0 +1,42 @@
+-- Google Drive agency OAuth + per-tenant folder links
+-- Idempotent.
+
+-- Agency-wide OAuth tokens (service role only; no client policies)
+create table if not exists public.agency_oauth (
+  provider text primary key,
+  account_email text,
+  access_token text not null,
+  refresh_token text,
+  expires_at timestamptz,
+  scopes text,
+  meta jsonb not null default '{}'::jsonb,
+  updated_at timestamptz not null default now()
+);
+
+alter table public.agency_oauth enable row level security;
+
+-- Widen integrations.provider check to include google_drive
+alter table public.integrations drop constraint if exists integrations_provider_check;
+alter table public.integrations
+  add constraint integrations_provider_check
+  check (provider in (
+    'meta_ads',
+    'google_ads',
+    'ga4',
+    'search_console',
+    'tag_manager',
+    'clientify',
+    'klaviyo',
+    'mailchimp',
+    'google_drive'
+  ));
+
+-- Seed google_drive slots for every tenant
+insert into public.integrations (tenant_id, provider, status, label)
+select t.id, 'google_drive', 'disconnected', 'Google Drive'
+from public.tenants t
+on conflict (tenant_id, provider) do nothing;
+
+-- Optional Drive file id on portal assets (mirror)
+alter table public.asset_files
+  add column if not exists drive_file_id text;