feat(rwg): internal-vs-external activation status + technical activation gate

Additive safety primitive for the reservation-onboarding workflow:
- RestaurantSetupStatus (internal lifecycle) + ExternalGoogleActivationStatus
  (external RwG), kept strictly separate
- canActivateExternalGoogle(): pure guard, external activation only when the
  E2E test passed AND required technical fields present AND status ready.
  Explicitly documented as a TECHNICAL readiness check, NOT a consent check;
  never activates, never mutates input.
- defaultExternalGoogleActivationStatus(): single source ensuring record
  creation/prep never auto-activates externally.
New files only; no change to existing shared interfaces/seed/DTO/admin, so
the live reservation flow is untouched. 7 unit tests, typecheck clean.