Handle Stale access token for Gmail and update the startup schema repair. Style the kanban for darkmode better

JobTrackerApi/Program.cs

@@ -537,6 +537,8 @@ CREATE TABLE IF NOT EXISTS "GmailConnections" (
     // Ensure ownership columns exist even on non-legacy DBs.
     EnsureColumn(conn, "Companies", "OwnerUserId", "ALTER TABLE Companies ADD COLUMN OwnerUserId TEXT NULL;");
     EnsureColumn(conn, "JobApplications", "OwnerUserId", "ALTER TABLE JobApplications ADD COLUMN OwnerUserId TEXT NULL;");
+    EnsureColumn(conn, "Correspondences", "Subject", "ALTER TABLE Correspondences ADD COLUMN Subject TEXT NULL;");
+    EnsureColumn(conn, "Correspondences", "Channel", "ALTER TABLE Correspondences ADD COLUMN Channel TEXT NULL;");
     EnsureColumn(conn, "Correspondences", "ExternalMessageId", "ALTER TABLE Correspondences ADD COLUMN ExternalMessageId TEXT NULL;");
 
     // Ensure data folder exists before creating/opening SQLite files.

JobTrackerApi/Services/GmailOAuthService.cs

@@ -228,7 +228,15 @@ public sealed class GmailOAuthService : IGmailOAuthService
             connection.AccessTokenExpiresAt is { } expiresAt &&
             expiresAt > DateTimeOffset.UtcNow.AddMinutes(1))
         {
-            return _protector.Unprotect(connection.EncryptedAccessToken);
+            try
+            {
+                return _protector.Unprotect(connection.EncryptedAccessToken);
+            }
+            catch (CryptographicException)
+            {
+                connection.EncryptedAccessToken = null;
+                connection.AccessTokenExpiresAt = null;
+            }
         }
 
         string refreshToken;