feat(google-analytics-sa): GA4 MCP with service account auth

[JonasJesus42]

Adds google-analytics-sa, a server-to-server variant of the Google Analytics MCP that reuses the eight existing GA tools verbatim (via new subpath exports) and swaps the OAuth bearer for a service account token — no per-user login, no refresh token to keep alive. GA4 grants access to the service account identity directly, so unlike google-calendar-sa there is no domain-wide delegation, no impersonation list and no fan-out; credentials resolve in one place, preferring a key pasted into the connection's SERVICE_ACCOUNT_JSON and falling back to a managed key from the GOOGLE_SERVICE_ACCOUNT_JSON site secret, so a customer can either keep quota in their own GCP project or just grant a Viewer role and skip key handling. A check-service-account-access tool makes setup self-service: it reports which credential is active, which email to grant, which properties are readable, and the exact next step when something is missing — returning failures as data rather than throwing, so a misconfigured install always gets an actionable answer.

The JWT-bearer implementation moves out of google-calendar-sa into @decocms/mcps-shared/google-service-account, which fixes three bugs on the way: subject becomes optional (the sub claim must be absent for GA4), the token cache key now includes client_email (two connections with different service accounts impersonating the same user previously shared a token), and the calendar fan-out no longer mints per-email tokens into a single shared MESH_REQUEST_CONTEXT.authorization inside a Promise.all, which made list_events across two users return one user's calendar duplicated. The new app wraps its transport in withAuth and is not added to auth-exemptions.json; 14 tests cover the JWT claims, cache isolation, error propagation and credential precedence, and all four check-service-account-access failure paths were exercised against a running server.

Deploying requires setting the GOOGLE_SERVICE_ACCOUNT_JSON secret on the google-analytics-sa site — without it only the bring-your-own-key mode works. The happy path (ok: true with properties listed) has not been verified against a real GA4 property.

🤖 Generated with Claude Code

---

Summary by cubic

Adds google-analytics-sa, a GA4 MCP that uses a service account instead of OAuth, removing per-user login and refresh token handling while keeping the same reporting tools. Also extracts JWT-bearer auth to @decocms/mcps-shared/google-service-account and fixes cache and fan-out bugs in google-calendar-sa.

• Reuses the eight google-analytics tools via new subpath exports; tools read the bearer from MESH_REQUEST_CONTEXT and run with a cloned env to avoid shared mutation.
• New check-service-account-access tool reports active credential source, service account email to grant, readable properties, and next steps; returns failures as data.
• @decocms/mcps-shared/google-service-account: makes subject optional and last; cache key now includes client_email; uses WebCrypto only; clearer key parsing errors (detects OAuth client files).
• google-calendar-sa now clones env per impersonated user and stops writing tokens into a shared authorization during fan-out.
• google-analytics adds exports (./tools, ./constants, ./client, ./schemas, ./types) and marks GOOGLE_CLIENT_ID/GOOGLE_CLIENT_SECRET optional for service-account builds.
• Transport is wrapped with withAuth; app is added to deploy.json and registry.json. Tests cover JWT claims, cache isolation, env cloning, error propagation, and credential precedence.

Bolded section: Rollout and migration

• Set the GOOGLE_SERVICE_ACCOUNT_JSON site secret on the google-analytics-sa site to enable managed credentials, or paste a key into the connection’s SERVICE_ACCOUNT_JSON.
• Grant the reported service account email Viewer access on the GA4 property, then run check-service-account-access to confirm.
• Update any internal calls to getServiceAccountAccessToken to the new signature: (serviceAccountJson, scopes, subject?).

^{Written for commit 42cc9bd. Summary will update on new commits.}