fix(oauth): Update Redis hash mapping when OAuth email changes

- Track old OAuth email to properly clean up Redis hash entries
- Remove stale email mappings when Gmail updates user email
- Ignore underscore-prefixed fields in account serialization
- Fixes PubSub notification matching for accounts with updated emails

This resolves issues where Google PubSub notifications fail to match
accounts after email addresses are updated or corrected during OAuth
profile synchronization.

Author: andris9

lib/account.js

@@ -194,6 +194,10 @@ class Account {
         const counters = {};
 
         Object.keys(accountData).forEach(key => {
+            if (key.startsWith('_')) {
+                return; //ignore
+            }
+
             let countMatch = key.match(/^stats:count:([^:]+):([^:]+)/);
             if (countMatch) {
                 const [, type, counter] = countMatch;
@@ -387,6 +391,10 @@ class Account {
         let result = {};
 
         Object.keys(accountData).forEach(key => {
+            if (key.startsWith('_')) {
+                // ignore
+                return;
+            }
             switch (key) {
                 case 'notifyFrom':
                 case 'syncFrom':
@@ -680,6 +688,9 @@ class Account {
 
         if (addProvider && !LEGACY_KEYS.includes(addProvider)) {
             pipeline = pipeline.sadd(`${REDIS_PREFIX}oapp:a:${addProvider}`, this.account);
+            if (accountData._oldOAuth2User && accountData._oldOAuth2User.toLowerCase() !== accountData.oauth2.auth?.user?.toLowerCase()) {
+                pipeline = pipeline.hdel(`${REDIS_PREFIX}oapp:h:${addProvider}`, accountData._oldOAuth2User.toLowerCase());
+            }
             if (accountData.oauth2?.auth?.user) {
                 // check if already exists
                 let existingAppBinding = await this.redis.hget(

lib/email-client/gmail-client.js

@@ -316,6 +316,7 @@ class GmailClient extends BaseClient {
 
         // Update account email if changed
         if (profileRes.emailAddress && accountData.oauth2.auth?.user !== profileRes.emailAddress) {
+            updates._oldOAuth2User = accountData.oauth2.auth?.user; // needed for cleanups
             updates.oauth2 = {
                 partial: true,
                 auth: Object.assign(accountData.oauth2.auth || {}, {