feat: add OpenAI OAuth, strict model overrides, and Gmail pull mode

src/config/schema.ts

@@ -49,6 +49,8 @@ const modelConfigBaseSchema = z.object({
   endpoint: z.string().optional(),
   api_key: z.string().optional(),
   auth_token: z.string().optional(),
+  /** Use OAuth credential flow (provider-specific). */
+  use_oauth: z.boolean().optional(),
   for: z.array(z.string()).optional(),
   num_gpu: z.number().optional(),
   context_window: z.number().optional(),
@@ -178,6 +180,30 @@ const gmailSchema = z.object({
   enabled: z.boolean().default(false),
   credentials_file: z.string().optional(),
   token_file: z.string().default('~/.config/flynn/gmail-token.json'),
+  /**
+   * Optional Google Cloud Pub/Sub topic for Gmail push notifications.
+   * Format: projects/<project-id>/topics/<topic>
+   * If omitted, push notifications are disabled and Flynn will use polling.
+   */
+  pubsub_topic: z.string().optional(),
+
+  /**
+   * Explicitly disable Gmail push watch registration even if pubsub_topic is set.
+   * Useful for environments where Google cannot reach the gateway (e.g. tailnet-only).
+   */
+  disable_push: z.boolean().default(false),
+
+  /**
+   * Optional Pub/Sub subscription for pull-based delivery (no inbound webhook required).
+   * Format: projects/<project-id>/subscriptions/<subscription>
+   */
+  pubsub_subscription_id: z.string().optional(),
+
+  /** How often to pull messages from pubsub_subscription_id (e.g. '60s'). */
+  pubsub_pull_interval: z.string().default('60s'),
+
+  /** Max messages to pull per cycle (1..100). */
+  pubsub_max_messages: z.number().min(1).max(100).default(10),
   watch_labels: z.array(z.string()).default(['INBOX']),
   poll_interval: z.string().default('300s'),
   history_start: z.string().optional(),  // ISO date string — only process emails after this date