auth setup: pasted OAuth Client ID is not trimmed — trailing whitespace causes 401 invalid_client at login

Start at the setup wizard's stage_configure_oauth input handling and trace how values are written to client_secret.json and loaded from environment variables. Verify the behavior with a pasted Client ID and Client Secret containing surrounding whitespace; done means the stored and loaded OAuth values no longer preserve that whitespace and login no longer sends it to Google.

Environment

• gws 0.22.5 (Homebrew googleworkspace-cli)
• macOS 15 (arm64)

Steps to reproduce

1. Run the interactive wizard: gws auth setup --project <project-id>
2. At Step 5/5 ("OAuth credentials — Waiting for manual input..."), paste a Client ID that ends with a trailing space (very easy to pick up when copying from the Cloud Console credentials page or a chat/notes app)
3. Complete the wizard and let it start gws auth login

What happens

The wizard stores the Client ID verbatim (trailing space included) in ~/.config/gws/client_secret.json:

"client_id": "1234567890-abcdefghij.apps.googleusercontent.com "

The generated authorization URL then contains an encoded trailing space right before the next query parameter:

...&client_id=1234567890-abcdefghij.apps.googleusercontent.com%20&prompt=select_account+consent

Google rejects the request with "The OAuth client was not found." / Error 401: invalid_client, which is quite hard to trace back to an invisible character — the pasted value looks correct in the terminal, and gws auth setup reports success.

Follow-up runs of the wizard pre-fill the stored (dirty) value, so the error persists across re-runs and survives what otherwise looks like a clean re-setup.

Expected behavior

Trim leading/trailing whitespace from the pasted Client ID and Client Secret in the setup wizard input handling (stage_configure_oauth), and ideally also when loading values from client_secret.json / env vars, so a stray space can never produce a misleading invalid_client error.

Workaround

Manually edit ~/.config/gws/client_secret.json and remove the trailing space from client_id, then re-run gws auth login.