Restrict Google OAuth to youtube.force-ssl and document zero Google data sharing.

Addresses Google OAuth verification feedback on scopes and privacy disclosure.

lib/auth.ts

@@ -1,5 +1,6 @@
 import { NextAuthOptions } from "next-auth";
 import GoogleProvider from "next-auth/providers/google";
+import { encryptSecret } from "./crypto/secrets";
 import { prisma } from "./db";
 import { getInitialQuotaResetAt } from "./quota";
 import { fetchYouTubeChannel } from "./youtube/upload";
@@ -18,8 +19,8 @@ export const authOptions: NextAuthOptions = {
             "openid",
             "email",
             "profile",
-            "https://www.googleapis.com/auth/youtube.upload",
-            "https://www.googleapis.com/auth/youtube.readonly",
+            // Single YouTube Data API scope (covers upload, channel, and playlist APIs)
+            "https://www.googleapis.com/auth/youtube.force-ssl",
           ].join(" "),
         },
       },
@@ -49,12 +50,15 @@ export const authOptions: NextAuthOptions = {
           account.refresh_token,
         );
 
+        const accessToken = encryptSecret(account.access_token);
+        const refreshToken = encryptSecret(account.refresh_token);
+
         await prisma.youTubeConnection.upsert({
           where: { userId: dbUser.id },
           create: {
             userId: dbUser.id,
-            accessToken: account.access_token,
-            refreshToken: account.refresh_token,
+            accessToken,
+            refreshToken,
             expiresAt: account.expires_at
               ? new Date(account.expires_at * 1000)
               : new Date(Date.now() + 3600 * 1000),
@@ -62,8 +66,8 @@ export const authOptions: NextAuthOptions = {
             channelTitle: channel.channelTitle,
           },
           update: {
-            accessToken: account.access_token,
-            refreshToken: account.refresh_token,
+            accessToken,
+            refreshToken,
             expiresAt: account.expires_at
               ? new Date(account.expires_at * 1000)
               : new Date(Date.now() + 3600 * 1000),