GitHub: add /v3/auth/github/native-callback. GitHub OAuth Apps reject
custom URL schemes as the Authorization callback URL, so the iOS App
sends our https endpoint as redirect_uri; this route runs the existing
exchangeGithubCode/upsertGithubUser pipeline and 302s back to
codetime://oauth/github?token=…&state=… for ASWebAuthenticationSession
to pick up.

Google: add POST /v3/auth/google/native (JSON). The iOS App handles
Google's /authorize leg locally (iOS-type Google clients allow custom
scheme callbacks), then posts the code + PKCE verifier here; we exchange
with Google's /token endpoint as a public client — no client_secret —
and verify the returned ID token. Requires the new GOOGLE_IOS_CLIENT_ID
env var so we don't reuse the web client's audience.

Util: exchangeGoogleCode() does the PKCE token exchange; verifyGoogleIdToken
now takes an optional expectedAudience override so the iOS client's ID
tokens validate against their own audience rather than the web one.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

token_v1 is the deprecated cookie-only auth field — we shouldn't be
handing it to the device. Both native sign-in routes now return the
user's upload_token instead; the existing `user_guard` already accepts
`Authorization: Bearer <upload_token>` (same path the CLI ingest uses),
so no guard change is required.

`upsert{Github,Google}User` now return both tokens (callers destructure
what they need — web stays on token_v1 for the cookie pair, app picks
upload_token). The empty-token mitigation is extended to upload_token
so legacy rows that landed with an empty string also self-heal on
first sign-in.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

…ne spine

resolveRange() already honours since/until (custom window), days (rolling) and tz (bucket alignment), but they were missing from the OpenAPI spec so generated clients couldn't reach them. All optional — existing range-based calls are unaffected. Lets a client request an exact calendar-day window (since=start-of-today, until=now, tz).

The active-time metrics (total, by-project, by-source) summed
agent_sessions.duration_ms, which is the session wall-clock span
(first→last event). That counts the idle gaps between turns — reading,
AFK — as active time, inflating the totals.

Switch the three duration aggregates to sum agent_turns.duration_ms,
which excludes between-turn idle. Turns are filtered by last_event_at to
mirror the session range filter. Per-source session counts stay on
agent_sessions so they aren't multiplied by turn rows.

Read-side only: takes effect on next dashboard load, no migration, no
CLI change, no re-ingest.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>