feat(seo): account-management verbs (connect/accounts/forget) + connect.sh wrapper

tokenstore remove/clear, fetch.sh forget dispatch, and a connect.sh wrapper
that sources ~/.claude/.env internally and runs from any project. /seo now
routes connect|accounts|forget before the audit flow; Makefile seo-connect
delegates to the wrapper. Labels are guarded to shell-safe ASCII (POSIX case,
whole-string, C-locale) as defense-in-depth; forget output states local
removal is not a Google-side revocation.

Makefile

@@ -25,9 +25,8 @@ onboard: link ## Onboard an existing project (run from the project directory)
 seo-connect: ## Connect a Google account for /seo FULL (creates venv, OAuth consent)
 	@python3 -m venv "$$HOME/.claude/.venv-seo-data"
 	@"$$HOME/.claude/.venv-seo-data/bin/pip" install -q -r lib/seo-data/requirements.txt
-	@bash -c 'set -a; [ -f "$$HOME/.claude/.env" ] && . "$$HOME/.claude/.env"; set +a; \
-	 read -r -p "Label for this account (e.g. client-a): " label; \
-	 "$$HOME/.claude/.venv-seo-data/bin/python3" lib/seo-data/connect.py --label "$$label"'
+	@bash -c 'read -r -p "Label for this account (e.g. client-a): " label; \
+	 bash lib/seo-data/connect.sh --label "$$label"'
 
 test: ## Run deterministic tests (lib/tests/*.test.sh + lib/gitflow-test.sh + lib/tests/run-*.sh)
 	@fail=0; for t in lib/tests/*.test.sh lib/seo-data/*.test.sh lib/gitflow-test.sh lib/tests/run-*.sh; do \