test(api): cover google auth token failures

[pengyuayn]

Summary

• Add focused service-level coverage for Google tokeninfo success and failure paths.
• Cover wrong audience, unverified email, non-OK tokeninfo responses, expired/missing PKCE state, token exchange failures, and PKCE state deletion before code exchange.
• Keep the tests aligned with the current implementation, which validates tokeninfo through fetch and leaves user persistence to the auth route/database layer.

Closes #401.

Verification

• ./node_modules/.bin/prettier --check apps/api/src/services/google-auth.test.ts
• ./node_modules/.bin/vitest run apps/api/src/services/google-auth.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose

Note

• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit is currently blocked by an existing syntax error in apps/api/src/routes/leaderboard.ts:196, outside this change.