feat(api): switch OAuth scope to gmail.modify

Enable archive, label, and draft CLI operations after users re-consent; keep the web UI read-only.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/config.js

@@ -17,7 +17,7 @@ export const GOOGLE_REDIRECT_URI =
   process.env.GOOGLE_REDIRECT_URI || "http://localhost:5173/callback";
 export const SESSION_SECRET = process.env.SESSION_SECRET || "";
 
-export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.readonly";
+export const GMAIL_SCOPE = "https://www.googleapis.com/auth/gmail.modify";
 export const OAUTH_SCOPES = [
   GMAIL_SCOPE,
   "openid",

apps/web/src/pages/Login.jsx

@@ -17,8 +17,9 @@ export default function Login() {
         <div className="card-body gap-4">
           <h1 className="card-title text-2xl">Gmail Reader</h1>
           <p className="text-sm opacity-70">
-            Sign in with Google to list, search, and read mail. Access is
-            read-only.
+            Sign in with Google to list, search, and read mail in this UI. The
+            UI is read-only; the CLI can archive, label, and create drafts
+            after you grant <code>gmail.modify</code>.
           </p>
           {error ? (
             <div role="alert" className="alert alert-error text-sm">