Add auto-forwarding of java.no emails to personal email

[Alexanderamiri]

Summary

• When the team-provisioner creates or syncs hero accounts, it now sets up Gmail auto-forwarding so all mail to the java.no address is forwarded to the member's personal email (copy kept in inbox)
• Uses domain-wide delegation to impersonate each user via the Gmail Settings API — forwarding addresses are accepted without verification
• Applies to both new and existing accounts (idempotent — skips already-configured forwarding)

Changes

• Added gmail.settings.sharing scope to GOOGLE_SCOPES
• New _get_user_google_access_token() — mints per-user JWT tokens (cached)
• New _setup_email_forwarding() — registers forwarding address + enables auto-forwarding
• Called after account creation in handle_sync_groups_and_heros for both new and existing accounts

Prerequisites

• gmail.settings.sharing scope added to domain-wide delegation in Google Admin console ✅

Test plan

• Deploy Lambda, then merge registry PR Wire module expander into CI, remove old generator #21 (members sync)
• Verify forwarding is active on a newly created java.no account
• Verify forwarding is set up for an existing account (e.g. alexander.amiri@java.no)

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Acquiring state lock. This may take a few moments...

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambdas.aws_lambda_function.team_provisioner will be updated in-place
  ~ resource "aws_lambda_function" "team_provisioner" {
        id                             = "javabin-team-provisioner"
      ~ last_modified                  = "2026-03-26T20:54:45.000+0000" -> (known after apply)
      ~ source_code_hash               = "7DSejz3Xn0CiM4UkSgYjwAnhf5pjehbiOrllxTrgfeM=" -> "rrMJrrtDWXfkKLJhLYioRSRN00lpBIeA7M04WMUYFSY="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine Lambda function code update for team_provisioner with source code hash change.

• ✅ [routine] Lambda function team_provisioner source code updated (hash change from 7DSejz3Xn0CiM4UkSgYjwAnhf5pjehbiOrllxTrgfeM= to rrMJrrtDWXfkKLJhLYioRSRN00lpBIeA7M04WMUYFSY=). This is an in-place update with no infrastructure changes.
• ✅ [routine] No resources being created or destroyed. Only metadata update (last_modified timestamp) alongside code deployment.
• ✅ [routine] No security group, IAM policy, or permission changes detected. Existing access controls remain unchanged.
• ✅ [routine] No cost implications. Lambda function configuration remains the same; only code is updated.
• ✅ [routine] No force-replacement or data loss risk. Update is non-destructive and maintains function availability.

[github-actions]

Terraform Plan

🚧 Changes detected — Plan: 0 to add, 1 to change, 0 to destroy.

Plan output

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # module.lambdas.aws_lambda_function.team_provisioner will be updated in-place
  ~ resource "aws_lambda_function" "team_provisioner" {
        id                             = "javabin-team-provisioner"
      ~ last_modified                  = "2026-03-26T20:54:45.000+0000" -> (known after apply)
      ~ source_code_hash               = "7DSejz3Xn0CiM4UkSgYjwAnhf5pjehbiOrllxTrgfeM=" -> "/tK4IAED6H3qJU5jH2WkSd1SstJ2tcnzCMThkQEBq/0="
        tags                           = {}
        # (21 unchanged attributes hidden)

        # (4 unchanged blocks hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "tfplan"

---

LLM Review

Risk: 🟢 LOW

Routine Lambda function code update for team_provisioner with source code hash change.

• ✅ [routine] Lambda function team_provisioner source code updated (hash change from 7DSejz3Xn0CiM4UkSgYjwAnhf5pjehbiOrllxTrgfeM= to /tK4IAED6H3qJU5jH2WkSd1SstJ2tcnzCMThkQEBq/0=). This is an in-place update with no infrastructure changes.
• ✅ [routine] Last modified timestamp will be updated automatically by AWS. No manual configuration changes detected.
• ✅ [routine] No IAM permissions, security groups, or access controls are being modified. Function configuration remains unchanged.
• ✅ [routine] No resources are being created or destroyed. This is a code deployment only affecting a single Lambda function.
• ✅ [routine] No cost implications - existing Lambda function is being updated in-place without scaling or configuration changes.