Audited read-only MCP gateway to Workspace data

One access layer over Calendar, Gmail, and receipts that other tools call instead of each wiring its own OAuth — per-consumer bearer tokens, a policy file, and an audit table of every call.

• Consumers: the reconciliation engine and finance; tokens rotated per consumer, revocation checklist maintained