Keep Google-only accounts out of the M365 scan

Graph returned 404 for /users/google:<email>/mailFolders: Google-
Workspace-only accounts (id "google:<email>") reached the M365 scan.

- getSelectedUsers() fell back to "every ticked checkbox in the DOM"
  whenever no M365 account was ticked — including Google-only rows. The
  fallback is now only used before the user list has loaded, and never
  includes google: rows.
- startScan() skips the M365 part (with a log line) when M365 sources are
  ticked but no M365 accounts are: the server treats an empty account
  list as "every user in the tenant".
- run_scan: _resolve_manual_users -> _resolve_scan_users, which now also
  drops google: ids (reported as a phase message). Covers scheduled scans
  and profiles that already contain Google-only accounts. Never widens to
  all users.

Tests: 3 new in tests/test_manual_users.py; the run_scan one fails on the
old engine with exactly the reported Graph call.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

static/js/scan.js

@@ -569,7 +569,13 @@ function startScan(resume) {
   document.getElementById('resumeBanner').style.display = 'none';
   document.getElementById('logPanel').innerHTML = '<div class="log-line log-live" id="logLive" style="display:none"></div>';
   try { sessionStorage.removeItem(_LOG_SESSION_KEY); } catch(e) {}
-  S._m365ScanRunning   = sources.length > 0;
+  // The M365 scan needs explicit accounts — the server treats an empty list as
+  // "every user in the tenant". With only Google accounts ticked, skip it.
+  const runM365 = sources.length > 0 && user_ids.length > 0;
+  if (sources.length && !runM365) {
+    log(t('m365_no_m365_accounts', 'No Microsoft 365 accounts selected — skipping the Microsoft 365 sources.'), 'warn');
+  }
+  S._m365ScanRunning   = runM365;
   S._googleScanRunning = googleSources.length > 0;
   S._fileScanRunning   = fileSources.length > 0;
   S._srcPct = { m365: 0, google: 0, file: 0 };
@@ -613,8 +619,8 @@ function startScan(resume) {
   }
 
   setTimeout(() => {
-    // Fire M365 scan if any M365 sources are selected
-    if (sources.length > 0) {
+    // Fire M365 scan if any M365 sources and accounts are selected
+    if (runM365) {
       fetch('/api/scan/start', {
         method: 'POST', headers: {'Content-Type':'application/json'},
         body: JSON.stringify({sources, user_ids, options, resume: !!resume,