Keep Google-only accounts out of the M365 scan

Graph returned 404 for /users/google:<email>/mailFolders: Google-
Workspace-only accounts (id "google:<email>") reached the M365 scan.

- getSelectedUsers() fell back to "every ticked checkbox in the DOM"
  whenever no M365 account was ticked — including Google-only rows. The
  fallback is now only used before the user list has loaded, and never
  includes google: rows.
- startScan() skips the M365 part (with a log line) when M365 sources are
  ticked but no M365 accounts are: the server treats an empty account
  list as "every user in the tenant".
- run_scan: _resolve_manual_users -> _resolve_scan_users, which now also
  drops google: ids (reported as a phase message). Covers scheduled scans
  and profiles that already contain Google-only accounts. Never widens to
  all users.

Tests: 3 new in tests/test_manual_users.py; the run_scan one fails on the
old engine with exactly the reported Graph call.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

static/js/users.js

@@ -461,10 +461,17 @@ function getSelectedUsers() {
       { id: u.id, displayName: u.displayName, userRole: u.userRole || 'other' },
       u.manual ? { manual: true, email: u.email || '' } : {}));
   }
-  // Fallback to DOM if S._allUsers not yet populated
-  return Array.from(document.querySelectorAll('.account-check:checked')).map(cb => ({
-    id: cb.dataset.id, displayName: cb.dataset.name, userRole: cb.dataset.role || 'other'
-  }));
+  // Once the user list is loaded it is authoritative: no ticked M365 users means
+  // none. (Falling back to the DOM here collected every ticked checkbox —
+  // including Google-only "google:<email>" rows — and sent them to the M365
+  // scan, where Graph 404s on them.)
+  if (S._allUsers.length) return [];
+  // Fallback to DOM only while S._allUsers is not yet populated
+  return Array.from(document.querySelectorAll('.account-check:checked'))
+    .filter(cb => !String(cb.dataset.id || '').startsWith('google:'))
+    .map(cb => ({
+      id: cb.dataset.id, displayName: cb.dataset.name, userRole: cb.dataset.role || 'other'
+    }));
 }
 
 // ── Window exports (HTML handlers + cross-module calls) ─────────────────────