fix: guardar OAuth Google con upsert real (PATCH vacío no insertaba)

El callback creía haber guardado el token y fallaba al emparejar Drive
con «no conectado». Upsert on_conflict=provider + match no bloquea OAuth.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/lib/google-drive.ts

@@ -133,29 +133,27 @@ export async function saveAgencyOAuth(opts: {
   };
   if (opts.refreshToken) row.refresh_token = opts.refreshToken;
 
-  // Upsert: try PATCH then POST
-  const base = `${supabaseUrl()}/rest/v1/agency_oauth?provider=eq.${DRIVE_PROVIDER}`;
-  const patch = await fetch(base, {
-    method: 'PATCH',
-    headers: {
-      ...headers,
-      'Content-Type': 'application/json',
-      Prefer: 'return=minimal',
-    },
-    body: JSON.stringify(row),
-  });
-  if (patch.ok) return;
-
-  const ins = await fetch(`${supabaseUrl()}/rest/v1/agency_oauth`, {
-    method: 'POST',
-    headers: {
-      ...headers,
-      'Content-Type': 'application/json',
-      Prefer: 'resolution=merge-duplicates',
-    },
-    body: JSON.stringify(row),
-  });
-  if (!ins.ok) throw new Error(`save oauth: ${(await ins.text()).slice(0, 300)}`);
+  // PostgREST PATCH returns 204 even when 0 rows match — do not treat that as success.
+  // Upsert on primary key `provider`.
+  const upsert = await fetch(
+    `${supabaseUrl()}/rest/v1/agency_oauth?on_conflict=provider`,
+    {
+      method: 'POST',
+      headers: {
+        ...headers,
+        'Content-Type': 'application/json',
+        Prefer: 'resolution=merge-duplicates,return=representation',
+      },
+      body: JSON.stringify(row),
+    }
+  );
+  if (!upsert.ok) {
+    throw new Error(`save oauth: ${(await upsert.text()).slice(0, 300)}`);
+  }
+  const saved = (await upsert.json()) as unknown[];
+  if (!Array.isArray(saved) || saved.length === 0) {
+    throw new Error('save oauth: upsert no escribió filas');
+  }
 }
 
 type OAuthRow = {