/solicitar-acceso GET not genuine-Google gated (asymmetric with SUBMIT)

Found during fleet GoTrue roleless-path sweep: page.tsx:14 checked only user?.email truthy; SUBMIT on same form correctly gated with extractSingleGoogleIdentity. Fixed reusing the same helper, /login?error=not-google redirect (callback's non-Google branch, not the no-profile landing — no-profile invites a request, wrong for a non-Google session), + warn-tier appEvents row on rejection (pages applog rail, nothing legitimate should ever hit this branch). Class-A, shipped f428a00/v2.59.3 under audit-unavailable waiver, pmmaster reviewing hand, retro cold-brief owed audit-mars-ca.