gmail proxy tool with token refresh, claude pro bearer auth, pi --list-models stderr fallback, tool object input type

- add getValidGoogleAccessToken helper and use it in email-cron, email account auth resolver, and the new gmail proxy
- POST /api/integrations/google/gmail-proxy forwards arbitrary gmail rest calls server-side, with auto-refreshed oauth
- pi-manager and claude user-instance inject OFFICER_API_URL + per-session JWT so tools can call back as the user
- claude anthropic proxy uses Authorization: Bearer + preserves any anthropic-beta headers (pro oauth tokens are rejected via x-api-key, and overwriting the beta header broke context_management)
- pi --list-models: fall back to stderr when stdout is empty (pi v0.73.1 writes the table to stderr)
- mcp tool server + pi tool loader: accept type: object inputs so json bodies stay structured

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/servers/api/email/accounts.ts

@@ -5,9 +5,9 @@ import {
   getEmailAccount,
   createEmailAccount,
   deleteEmailAccount,
-  getUserIntegration,
   updateEmailAccountStatus,
 } from 'officerdb';
+import { getValidGoogleAccessToken } from '../integrations/google-auth';
 import { validateImapConnection } from './imap-validate';
 import { enqueueJob, listAllJobs } from '../../queue/init';
 import { openEmailDb, getSyncMeta } from './email-db';
@@ -237,11 +237,12 @@ async function resolveAuth(
     const integrationId = credentials.userIntegrationId as number | undefined;
     if (!integrationId) return { ok: false, error: 'Missing userIntegrationId for OAuth' };
 
-    const integration = await getUserIntegration(userId, 'google');
-    if (!integration) return { ok: false, error: 'Google integration not found' };
-
-    const config = integration.config as Record<string, unknown>;
-    const accessToken = config.accessToken as string | undefined;
+    let accessToken: string | null;
+    try {
+      accessToken = await getValidGoogleAccessToken(userId);
+    } catch (err) {
+      return { ok: false, error: `Token refresh failed — reconnect Google account: ${err instanceof Error ? err.message : err}` };
+    }
     if (!accessToken) return { ok: false, error: 'No access token available — reconnect Google account' };
 
     return { ok: true, auth: { accessToken } };