docs: clarify GAM setup with three clear paths and environment validation

[bokelley]

Summary

Addresses user feedback from first-time setup experience. This PR separates concerns and provides clear, upfront guidance for different deployment scenarios:

• Path 1 (Mock): Zero-config quick start with working example
• Path 2 (GAM OAuth): Prerequisites clearly documented upfront
• Path 3 (Service Account): Production-ready alternative

Changes

• Updated README with three distinct setup paths with prerequisites clearly listed before setup begins
• Reorganized .env.template with explicit path annotations and default test mode enabled
• Added environment validation in Admin UI: warning banner when GAM OAuth not configured
• Service Account section now visually highlighted as "Recommended" when OAuth unavailable
• New gam_prerequisites_check.py script for validation
• Enhanced troubleshooting with specific error resolution steps

Key Improvements

• Prerequisites Upfront: No more hidden requirements discovered mid-setup
• Test Mode Default: New users can get started without any OAuth setup
• Clear Error Guidance: When missing config, UI shows exact steps to fix
• Better UX: Gradual path from Mock → GAM Testing → Production

[github-actions]

IPR Policy Agreement Required

Thank you for your contribution! Before we can accept your pull request, you must agree to our Intellectual Property Rights Policy.

By making a Contribution, you agree that:

• You grant the Foundation a perpetual, irrevocable, worldwide, non-exclusive, royalty-free copyright license to your Contribution
• You grant a patent license under any Necessary Claims
• You represent that you own or have sufficient rights to grant these licenses

To agree, please comment below with the exact phrase:

I have read the IPR Policy

You can read the full IPR Policy here.

---

I have read the IPR Policy

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}