- Add SA key in Secret Manager (gmail-sa-key)
- Fix require_iap middleware to accept Bearer tokens
- Fix require_auth decorator to accept Bearer tokens
- Implement _notify_email with service_account.Credentials + domain-wide delegation
- Set GMAIL_DEFAULT_SENDER and GMAIL_ALLOWED_SENDERS env vars