…l timeout

…en guard

DROIDRUN_OAUTH_MANUAL now only enables manual paste for "1", "true", or
"yes" instead of any non-empty value.  Removed the hard-fail guard when
Google omits a refresh token — the access token is still usable.

…anual

Check done before setting manual_failed so a late browser callback is
not masked by a bad paste.  Also add one-retry logic to the standalone
login_manual() path in all three OAuth helpers.

…odes