Fix missing Google login on canary via 1Password-backed OAuth secrets

Restores the “Log in with Google” button on the canary environment, where it was previously missing. The Google OAuth client credentials (TUIST_GOOGLE_OAUTH_CLIENT_ID / TUIST_GOOGLE_OAUTH_CLIENT_SECRET) are now sourced from 1Password via External Secrets Operator across all managed environments, the same way GitHub App credentials already are. A new server.google.managedSecrets toggle (default off for self-hosted installs) renders the ExternalSecret and env refs only for managed environments. Operators on managed clusters must ensure a GOOGLE_OAUTH item exists in the per-env tuist-k8s- 1Password vault, and canary operators must register the new client’s redirect URI (https://canary.tuist.dev/users/auth/google/callback) in Google Cloud Console.