custom_auth: GOOGLE_CLIENT_IDS is hardcoded to [WEB, ANDROID] — no env var for desktop client_id

[emooreatx]

Problem

hooks/custom_auth.py builds GOOGLE_CLIENT_IDS from exactly two env vars:

GOOGLE_CLIENT_ID_WEB     = os.environ.get("GOOGLE_CLIENT_ID", "…")
GOOGLE_CLIENT_ID_ANDROID = os.environ.get("GOOGLE_CLIENT_ID_ANDROID", "…")
GOOGLE_CLIENT_IDS        = [GOOGLE_CLIENT_ID_WEB, GOOGLE_CLIENT_ID_ANDROID]

There is no mechanism to add additional client IDs via environment — unlike Apple, which already has this pattern:

APPLE_CLIENT_IDS_EXTRA = os.environ.get("APPLE_CLIENT_IDS", "")
APPLE_CLIENT_IDS = [APPLE_CLIENT_ID] + [x.strip() for x in APPLE_CLIENT_IDS_EXTRA.split(",") if x.strip()]

Impact

Desktop Google-OAuth CIRISProxy users (aud = 265882853697-760hu05lq7onca4iq9rtl49v9gho0pdc.apps.googleusercontent.com) get HTTP 401 Invalid token audience from the proxy even after the same client_id was successfully added to CIRISBilling's allowlist (CIRISBridge#5, fixed).

Requested fix

Apply the same GOOGLE_CLIENT_IDS_EXTRA pattern Google that Apple already has:

GOOGLE_CLIENT_IDS_EXTRA = os.environ.get("GOOGLE_CLIENT_IDS_EXTRA", "")
GOOGLE_CLIENT_IDS = [GOOGLE_CLIENT_ID_WEB, GOOGLE_CLIENT_ID_ANDROID] + \
    [x.strip() for x in GOOGLE_CLIENT_IDS_EXTRA.split(",") if x.strip()]

CIRISBridge would then set GOOGLE_CLIENT_IDS_EXTRA=265882853697-760hu05lq7onca4iq9rtl49v9gho0pdc.apps.googleusercontent.com in the proxy env template and deploy — no further proxy code changes needed.