User-delegated access (like Zapier)
✓ Minimal scopes for security ✓ User can revoke anytime ✓ Google Ads only (no Drive)