Verify Google Connection

Prove the keyless Google Cloud connection works and report exactly what Bluejay can reach. Mints a federated + impersonated token, then probes each configured service with a cheap read. Returns per-service reachable/denied so the customer sees their granted access instead of guessing at IAM.

Named verify_* rather than test_* so it isn't mistaken for (or collected as) a test; the customer-facing route stays /test-connection.