feat(05-10): oauth_initiate returns 200 JSON {url} instead of 302 redirect

- Remove response_class=RedirectResponse from @router.get decorator
- Replace both RedirectResponse(status_code=302) returns with JSONResponse({url})
- Frontend can now inject Bearer header before navigating to OAuth URL (T-05-10-01)
- Update test_connect_google_drive to expect 200 JSON (regression fix)

backend/tests/test_cloud.py

@@ -178,7 +178,11 @@ async def test_factory_returns_correct_backend():
 # ── CLOUD-01: OAuth connect / WebDAV connect ──────────────────────────────────
 
 async def test_connect_google_drive(async_client, db_session, monkeypatch):
-    """GET /api/cloud/oauth/initiate/google_drive redirects to Google's OAuth URL."""
+    """GET /api/cloud/oauth/initiate/google_drive returns 200 JSON {url} pointing to Google OAuth.
+
+    Updated in plan 05-10: endpoint now returns JSON instead of 302 redirect
+    so the frontend can inject the Bearer Authorization header before navigating.
+    """
     from main import app
 
     auth = await _create_user_and_token(db_session, role="user")
@@ -187,15 +191,23 @@ async def test_connect_google_drive(async_client, db_session, monkeypatch):
     fake_redis = FakeRedis()
     app.state.redis = fake_redis
 
-    resp = await async_client.get(
-        "/api/cloud/oauth/initiate/google_drive",
-        headers=auth["headers"],
-        follow_redirects=False,
+    mock_flow = MagicMock()
+    mock_flow.authorization_url.return_value = (
+        "https://accounts.google.com/o/oauth2/auth?scope=drive&state=test",
+        "test",
     )
 
-    assert resp.status_code == 302
-    location = resp.headers.get("location", "")
-    assert "accounts.google.com" in location
+    with patch("google_auth_oauthlib.flow.Flow.from_client_config", return_value=mock_flow):
+        resp = await async_client.get(
+            "/api/cloud/oauth/initiate/google_drive",
+            headers=auth["headers"],
+            follow_redirects=False,
+        )
+
+    assert resp.status_code == 200
+    data = resp.json()
+    assert "url" in data
+    assert "accounts.google.com" in data["url"]
 
     # Clean up
     app.state.redis = None