feat(api): switch OAuth scope to gmail.modify

Enable archive, label, and draft CLI operations after users re-consent; keep the web UI read-only.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/pages/Login.jsx

@@ -17,8 +17,9 @@ export default function Login() {
         <div className="card-body gap-4">
           <h1 className="card-title text-2xl">Gmail Reader</h1>
           <p className="text-sm opacity-70">
-            Sign in with Google to list, search, and read mail. Access is
-            read-only.
+            Sign in with Google to list, search, and read mail in this UI. The
+            UI is read-only; the CLI can archive, label, and create drafts
+            after you grant <code>gmail.modify</code>.
           </p>
           {error ? (
             <div role="alert" className="alert alert-error text-sm">