bug: gws auth setup writes double-serialized client_id/client_secret into client_secret.json (causes 401 invalid_client) #947

gws version: 0.22.5 (installed via npm on Windows 10)

Steps to reproduce:

1. Run gws auth setup
2. Complete gcloud auth login when prompted
3. Choose "Create new project"
4. Let the wizard finish (creates OAuth client, writes ~/.config/gws/client_secret.json)
5. Run gws auth login

Actual behavior:
The generated client_secret.json has its client_id and client_secret fields filled with the entire JSON credentials object (double-serialized as a string) instead of the plain values:

{
  "installed": {
    "client_id": "{\"installed\":{\"client_id\":\"123-abc.apps.googleusercontent.com\",...,\"client_secret\":\"REDACTED\",...}}",
    "client_secret": "{\"installed\":{...same blob...}}"
  }
}

This causes every subsequent gws auth login attempt to fail with:

error[auth]: OAuth flow failed: Server error: invalid_client: The OAuth client was not found.

The printed "Open this URL in your browser to authenticate" link also contains the malformed client_id query param, so manually fixing the URL alone does not help until the underlying file is fixed.

Workaround:
Manually edit client_secret.json and replace client_id/client_secret with the actual plain values extracted from the nested string, then gws auth login works correctly.

Expected behavior:
gws auth setup should write the plain client_id/client_secret strings, not a re-serialized copy of the whole credentials object.