Adds a new mutation that accepts an email + raw OAuth token and upserts the account — creating it if it doesn't exist, updating credentials if it does. Covers all four scenarios with unit tests (new, existing, empty-email, empty-token validation).