Switch Gmail and Gcal to env-var OAuth delivery pattern

auth.deliver changes from as:file to as:env:
- Gmail: GMAIL_CREDS_JSON env var (Google authorized_user JSON)
- Gcal: GCAL_CREDS_JSON env var

mcp_config.env removed entirely — Skald injects the env var at runtime,
no path on disk needed.

Server scripts updated:
- Check GMAIL_CREDS_JSON / GCAL_CREDS_JSON env var first
- Use Credentials.from_authorized_user_info() instead of
  from_authorized_user_file()
- Fall back to file-based loading for standalone/legacy use
- _persist_creds only writes to disk when _creds_path is set

gcal/verify.py: support GCAL_CREDS_JSON env var with shared _check_api()

Docs (SKALD.md): updated examples, field table, connector table.

SKALD.md

@@ -130,9 +130,7 @@ Configurazione tecnica per l'attivazione del connector.
   ],
   "setup_instructions": [
     "Install dependencies: pip install -r requirements.txt",
-    "Create secrets/google_oauth_client.json with {\"client_id\": \"...\", \"client_secret\": \"...\"}",
-    "Run: python3 gmail_oauth_setup.py (opens browser for OAuth)",
-    "Set GMAIL_CREDS_PATH env var or place token at secrets/gmail_creds.json"
+    "Run: python3 gmail_oauth_setup.py (optional, for standalone use — Skald handles OAuth)"
   ],
   "docs": [
     {
@@ -149,17 +147,14 @@ Configurazione tecnica per l'attivazione del connector.
       "https://www.googleapis.com/auth/gmail.labels"
     ],
     "deliver": {
-      "as": "file",
+      "as": "env",
       "format": "google_authorized_user",
-      "path": "{secrets}/gmail_creds.json"
+      "env": "GMAIL_CREDS_JSON"
     }
   },
   "mcp_config": {
     "command": "python3",
-    "args": ["gmail_mcp_server.py"],
-    "env": {
-      "GMAIL_CREDS_PATH": "{secrets}/gmail_creds.json"
-    }
+    "args": ["gmail_mcp_server.py"]
   },
   "homepage": "https://mail.google.com",
   "icon_small": "icon_sm.svg",
@@ -233,7 +228,11 @@ Struttura che descrive come il connector gestisce l'autenticazione:
 // OAuth2 — provider SOLO slug (Skald risolve endpoint + client secrets)
 {"type": "oauth2", "provider": "google", "scopes": ["...", "..."]}
 
-// OAuth2 con deliver (come Skald consegna la credenziale al processo MCP)
+// OAuth2 con deliver (Skald inietta il JSON authorized_user via env var)
+{"type": "oauth2", "provider": "google", "scopes": ["..."],
+ "deliver": {"as": "env", "format": "google_authorized_user", "env": "GMAIL_CREDS_JSON"}}
+
+// OAuth2 con deliver su file (legacy)
 {"type": "oauth2", "provider": "google", "scopes": ["..."],
  "deliver": {"as": "file", "format": "google_authorized_user", "path": "{secrets}/gmail_creds.json"}}
 
@@ -253,6 +252,7 @@ Dichiara **come** Skald consegna la credenziale OAuth ottenuta al processo del s
 | `as` | ✅ | `"file"` (su disco) o `"env"` (variabile d'ambiente) |
 | `format` | ✅ | Nome della serializzazione — es. `"google_authorized_user"` (JSON Google che `from_authorized_user_file` legge), `"refresh_token"`, `"access_token"` |
 | `path` | solo `as=file` | Path con placeholder `{secrets}` (Skald lo espande a dir per-utente a runtime). DEVE matchare il path in `mcp_config.env`. |
+| `env` | solo `as=env` | Nome della variabile d'ambiente in cui Skald inietta l'intero JSON authorized_user. **Non va dichiarata in `mcp_config.env`** — Skald la inietta a runtime. |
 
 Il feed NON contiene MAI: `client_id`, `client_secret`, `endpoint` URL, `redirect_uri`. Questi sono risolti lato Skald a partire dal nome del `provider`.
 
@@ -439,10 +439,11 @@ sudo find /var/www/connectors.skaldagent.net/ -type f -exec chmod 644 {} \;
 | ID | Nome | Tipo | Scope | Auth | Verify |
 |----|------|------|-------|------|--------|
 | `tavily` | Tavily | `mcp_remote` | `global` | api_key (`{SECRET:tavilyApiKey}` in URL) | `verify.py` (HTTP probe `/search`) |
-| `gmail` | Gmail | `mcp_local` | `user` | oauth2 (Google) + deliver: `file/google_authorized_user` | ⏳ Fase 2 — OAuth via loopback listener |
-| `gcal` | Google Calendar | `mcp_local` | `user` | oauth2 (Google) + deliver: `file/google_authorized_user` | `verify.py` (creds load + API probe) |
+| `gmail` | Gmail | `mcp_local` | `user` | oauth2 (Google) + deliver: `env/google_authorized_user` (via `GMAIL_CREDS_JSON`) | ⏳ Fase 2 — OAuth via loopback listener |
+| `gcal` | Google Calendar | `mcp_local` | `user` | oauth2 (Google) + deliver: `env/google_authorized_user` (via `GCAL_CREDS_JSON`) | `verify.py` (creds load + API probe) |
 | `email` | Email (IMAP/SMTP) | `mcp_local` | `user` | password (env) | `verify.py` (IMAP+SMTP probe) |
 | `ssh` | SSH Remote Access | `mcp_local` | `user` | none (auth runtime per-alias) | — (nessun setup credential) |
 **Stato del verify-before-save in skald**: `email`, `tavily`, e `gcal` hanno `verify` completo
 (script + JSON output); `gmail` aspetta la Fase 2 (OAuth via loopback listener).
+(script + JSON output); `gmail` aspetta la Fase 2 (OAuth via loopback listener).
 Un connector senza `verify` viene attivato senza test — vedi § Senza verify.