feat(backend): expose connect-delegation flag on /api/config

[tyler-dane]

What

Adds google.connectDelegatedToSync to the public AppConfig returned by GET /api/config, populated from the global SYNC_CONNECTION_ROUTING switch via getConnectionDelegation().

This is the enabling half of web connect delegation (S38). The browser currently has no way to learn whether a deployment delegates Google connections to the sync service. Because the routing switch is a deployment-level posture (not per-user), the public, already-early-fetched /api/config is the least-invasive signal — as opposed to the session-authed, per-user /api/user/metadata.

The web consumer (fork the connect UX to the redirect flow when this is true) follows in a separate PR. Legacy stays the default; the field defaults to false, so legacy deployments are byte-compatible.

How it's fail-safe

• getConnectionDelegation() already fails safe to "legacy" unless an operator selected "sync" and a sync client is configured.
• The zod field uses .default(false), so a web client parsing an older backend response (field absent) reads it as false → legacy. No coordination window where the web breaks.

Testing

• bun packages/scripts/src/testing/test-mongo-env.ts backend -- './packages/backend/src/config/config.route.test.ts' → 3 pass.
• bun run type-check: zero new errors vs. origin/main (verified by set-difference against the pre-existing local baseline).
• Lint: ./node_modules/.bin/biome check clean on changed files.

Manual Testing Steps

1. GET /api/config on a default deployment → google.connectDelegatedToSync: false.
2. On a deployment with SYNC_CONNECTION_ROUTING=sync + SYNC_SERVICE_URL set → true.

🤖 Generated with Claude Code

---

Note

Low Risk
Additive public config field defaulting to false; no auth or connection behavior changes, only surfacing existing routing state.

Overview
GET /api/config now includes google.connectDelegatedToSync, set when the deployment’s global sync connection routing resolves to the sync service (redirect-based connect) rather than legacy in-backend code exchange.

The field is added to AppConfigSchema with z.boolean().default(false) so older responses without it still read as legacy. ConfigController.get derives the value from existing getConnectionDelegation() logic (same fail-safe as auth: sync only when routing is sync and a sync client exists).

Tests assert false on legacy/default deployments and route expectations, plus a unit test that true when sync routing and client config are set.

^{Reviewed by Cursor Bugbot for commit 35cdb96. Bugbot is set up for automated code reviews on this repo. Configure here.}