#1000 Gmail and Telegram connect are not atomic (token write, installation upsert, integration row in separate transactions)

EARS: When a tenant connects Gmail or Telegram, the token write, the app installation upsert and the integration row shall commit in one transaction, or none shall. FOUND in #924 review (L5): api/oauth_handlers/gmail.py callback calls _store_tokens (own transaction) then _install_gmail_for_tenant (another); api/oauth_handlers/telegram_int.py connect stores the bot token, installs the app and writes telegram_integrations separately. A failure in between leaves a token without installation or the reverse. The store accepts conn= (pass the same connection).