EVO-68: replace email-domain login gate with genuine-Google-identity gate

Class-A, plan-first. Drop isAllowedEmailDomainAsync as the auth/callback gate; new gate = provider=google + valid google sub. Access control stays on pre-created account match: unmatched genuine-Google login routes to /solicitar-acceso, MUST NOT auto-create a userRow. Plan must verify: (1) any existing auto-create-on-first-login path in venus auth/callback (if yes, must route unmatched to request form, not insert); (2) fate of systemSettings.allowedEmailDomains + reason=email-domain redirect (keep as dormant fallback vs remove — state call); (3) canonical-email unique index + existing-user bypass unaffected. Audit-venus-ca design-ping required before any code.