Sign in on a phone with no console work, in the browser's own session

Mobile OAuth reused the desktop client all along; what stopped it was the
browser. Sending the user out to Safari or Chrome backgrounds the app, iOS
suspends it, and the redirect carrying the code arrives at a socket nobody
is accepting on. The consent page now opens in front of the app instead, in
SFSafariViewController or a Chrome Custom Tab, so the loopback listener
stays live and the existing `installed` client is enough. Verified against
Google's real consent screen on a simulator and an emulator.

A per-platform client is still supported and is now an upgrade rather than a
prerequisite. On iOS it buys ASWebAuthenticationSession, which shares
Safari's session so nobody is asked to sign in to Google twice. Android
needs nothing: Custom Tabs share Chrome's cookies, measured rather than
assumed. iOS session sharing could not be confirmed on the simulator and
wants a real device.

Never an app-owned WebView: Google blocks it, and rightly, since a webview
the app controls can read the password typed into it.

Cancelling is no longer reported as a failure. AuthEvent carries a
`cancelled` flag, set by comparing against the constant every back-out path
returns, and Google's `access_denied` on desktop counts too.

Five frontend bugs found by driving the real UI, not by reading it: the
details card slid under the tab bar leaving its buttons unhittable; the
ghost click after a touch pressed a button in the card that tap had just
opened, opening the editor by itself; the swipe that pages the day was dead
over every read-only block; 84px of macOS traffic-light lane was reserved on
platforms with no traffic lights; and the desktop header ignored the top
safe area on an iPad. A first launch now says what to do next rather than
showing an empty grid, and accounts are named as Google accounts throughout.

src/components/Accounts.tsx

@@ -55,7 +55,7 @@ export function Accounts() {
   return (
     <Sheet
       open={showing}
-      title="Accounts"
+      title="Google accounts"
       onClose={close}
       foot={
         confirming ? undefined : (
@@ -67,7 +67,7 @@ export function Accounts() {
             disabled={connecting || phase === "working"}
             onClick={() => void connect()}
           >
-            Connect an account
+            Connect a Google account
           </button>
         )
       }
@@ -78,8 +78,8 @@ export function Accounts() {
           body={
             <p>
               The token is revoked and every calendar, event and pending write stored on this
-              computer for that account is deleted. Nothing changes in Google Calendar itself, and
-              you can connect the account again afterwards.
+              computer for that Google account is deleted. Nothing changes in Google Calendar
+              itself, and you can connect it again afterwards.
             </p>
           }
           confirmLabel="Disconnect"
@@ -127,7 +127,7 @@ export function Accounts() {
 
           {accounts.length === 0 && !connecting ? (
             <p className="panel-note">
-              No account is connected, so there is nothing to show on the grid yet.
+              Connect a Google account to see its calendars here. Nothing syncs until you do.
             </p>
           ) : (
             accounts.map((account) => (