EVO-68 Mars leg: replace email-DOMAIN login gate with genuine-Google-identity gate in auth/callback

EVO-68 (Elazar GO via pmmaster, Class-A, PLAN-FIRST + audit design-ping BEFORE impl). NOT open self-onboard: apps never auto-create accounts; humans pre-create from client data, user logs in with client-provided email, unmatched email routes to /solicitar-acceso for human match. Change is narrow: new auth/callback login rule = provider=google + valid google sub; DROP isAllowedEmailDomainAsync as the login gate. REAL access control stays: matching pre-created account must exist; genuine-Google login with NO matching account STILL goes to /solicitar-acceso and MUST NOT insert a userRow. Plan must verify+state: (a) does mars auth/callback have ANY auto-create-on-first-login path the domain gate was implicitly backstopping? if yes, unmatched-Google routes to request form NOT create-row; confirm no new auto-create introduced; (b) fate of systemSettings.allowedEmailDomains + reason=email-domain redirect once domain gate gone — keep dormant fallback for future non-Google providers OR remove, state the call; (c) canonical-email unique index + existing-user bypass unaffected — confirm. No push before audit design-ping.