Add provider-neutral task external-resource actions

[witbrock]

What changed

• add a provider-neutral external_resource_actions[] projection to task detail
• render zero or more safe open_resource actions in the task inspector
• resolve actions through a generic same-origin task route with typed access/resolution failures
• add Gmail as the first isolated provider, including actor-scoped profile authorisation, minimal threadId lookup, authorised-account selection, and Gmail thread URL construction
• add focused backend and frontend coverage for multiple providers/actions, unsafe descriptors, authority denial, redirects, and Gmail resolution

Why

Gmail-backed review tasks exposed only an opaque Gmail API message ID. Humans could inspect the task but could not navigate to the canonical source message. The fix needs to support future Calendar, Jira, Asana, form, and expense resources without adding provider branches to task creation, generic routes, or the UI.

User impact

The reported task now shows Open source in Gmail and opens the correct source thread/account. The generic contract supports multiple independent navigation actions on one task.

Effectful actions are intentionally not smuggled into this navigation contract. Their future authority, idempotency, receipt, canonical read-back, and recovery contract is tracked in JVNAUTOSCI-2648.

Validation

• 33 focused backend tests passed
• 4 focused frontend tests passed
• focused Ruff, Ruff formatting, ESLint, and git diff --check passed
• authenticated browser replay on the exact persisted task opened the correct Gmail source thread in the correct authorised account
• conflict-free virtual merge against current origin/main retained all six concept-name blobs from Fix canonical type cartouche names #392 and all eleven files from this change (17/17 exact blob checks)