gmail proxy tool with token refresh, claude pro bearer auth, pi --list-models stderr fallback, tool object input type

- add getValidGoogleAccessToken helper and use it in email-cron, email account auth resolver, and the new gmail proxy
- POST /api/integrations/google/gmail-proxy forwards arbitrary gmail rest calls server-side, with auto-refreshed oauth
- pi-manager and claude user-instance inject OFFICER_API_URL + per-session JWT so tools can call back as the user
- claude anthropic proxy uses Authorization: Bearer + preserves any anthropic-beta headers (pro oauth tokens are rejected via x-api-key, and overwriting the beta header broke context_management)
- pi --list-models: fall back to stderr when stdout is empty (pi v0.73.1 writes the table to stderr)
- mcp tool server + pi tool loader: accept type: object inputs so json bodies stay structured

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/servers/tool-loader-source.ts

@@ -3,7 +3,7 @@ import { Type, type TSchema } from '@sinclair/typebox';
 import { readdirSync, existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 
-type ToolParamType = 'string' | 'number' | 'boolean' | 'enum';
+type ToolParamType = 'string' | 'number' | 'boolean' | 'enum' | 'object';
 
 type ToolParam = {
   type: ToolParamType;
@@ -133,6 +133,9 @@ function buildSchema(inputs: Record<string, ToolParam>): TSchema {
       case 'boolean':
         schema = Type.Boolean({ description: param.description });
         break;
+      case 'object':
+        schema = Type.Record(Type.String(), Type.Unknown(), { description: param.description });
+        break;
       default:
         schema = Type.String({ description: param.description });
     }