Oauth Google Start

Begin a Google OAuth login.

Sets a short-lived state cookie, then 302s to Google’s authorize endpoint. The cookie + the state query param both carry the same nonce; the callback verifies they match (CSRF defence).