docs: record the Google Cloud project owner + the OAuth verification blocker

Creator-confirmed: the Cloud project (number 198374416003, from the ClientId) is
owned by llamachile.shop@gmail.com. Recorded because finding it cost a hunt, and
because the trap was assuming it was the same account as the YouTube channel used
in the app -- they are separate logins.

Also records what the repo had nothing on at all: the OAuth verification path, the
Testing-mode 100-user cap + 7-day refresh-token expiry that explains the repeated
re-consent, the sensitive-vs-restricted fork (a paid annual CASA assessment if
restricted), and two scope cleanups -- auth/youtube.force-ssl is redundant, and
ChannelStatsService's playlistItems.list needs no OAuth scope at all.

Docs only, no code touched.

HANDOFF.md

@@ -36,6 +36,34 @@ browser. **Coverage gap:** the *ordering* fix (defect 1) has no automated test
 hardcoded in `MainViewModel` and `ChangeAccountAsync` is private, so a real test would shell out to
 the browser. Wiring an auth seam into `MainViewModel` is a deliberate follow-up, not a bug-fix extra.
 
+## ⏭ NEXT STEP (2026-09-27) — Google OAuth verification: open blocker, nothing recorded before
+
+**Owning account (creator-confirmed): `llamachile.shop@gmail.com` ("gramps").** Cloud project number
+`198374416003` (from the ClientId). Open `https://console.cloud.google.com/apis/credentials?project=198374416003`
+signed in as that account. Note the project picker defaults to the **"Recent"** tab — switch to
+**"All"**. ⛔ Do not confuse this account with the YouTube channel account used in the app.
+
+**Answer these two, and the whole verification path is known:**
+1. OAuth consent screen **Publishing Status** — "Testing" or "In production"? If still *Testing*:
+   **100 test-user cap and refresh tokens expire every 7 days**, which is exactly why the creator kept
+   having to re-consent. Both limits vanish on going to production.
+2. Is `https://www.googleapis.com/auth/youtube` flagged **sensitive** or **restricted**? Sensitive →
+   Google review only (free, self-service, weeks). Restricted → adds an **annual CASA security
+   assessment by a Google-approved third party** (real cost, recurring, "several weeks" per Google).
+   Google publishes the scope list but **deliberately does not publish this classification** — the
+   indicator lives only in the console, so it cannot be researched, only looked up.
+
+**Scope cleanups found (2026-09-27, not yet done — both trivial, both reduce verification surface):**
+- `Services/YouTubeAuthService.cs:18` requests `auth/youtube` **+ `auth/youtube.force-ssl`**.
+  `force-ssl` is **redundant** — Google's liveChat docs list `auth/youtube` as an acceptable
+  alternative, and it is the broader of the two ("Manage your YouTube account" ⊃ "see/edit/delete
+  your videos, ratings, comments, captions"). Drop it: one fewer scope to justify, one fewer consent line.
+- `Services/ChannelStatsService.cs:107` calls `playlistItems.list` on the creator's own uploads
+  playlist (`UU…`) — **public data, needs no OAuth scope at all** (API key suffices). It currently
+  rides on the user's session token. Does not change the requested scope (`auth/youtube` is forced by
+  `liveBroadcasts.*`/`liveStreams.list` regardless) but that fetch should not need user credentials.
+- `auth/youtube` is **unavoidable**: no narrower scope covers live broadcast create/transition.
+
 ## ✅ DECIDED 2026-09-27 — pricing: `$10/mo` subscription, or `$400` lifetime, **no annual**
 
 **Creator's ruling, verbatim: *"Let's just go with $10 monthly recurring subscription for option