Add Google Sheets Apps Script mirror and update webhook payload

[Spbd1]

Motivation

• Make the Google Sheets mirror easy and reliable for non-expert deployers by providing a ready-to-copy Apps Script receiver and clear instructions.
• Ensure the mirror validates a shared secret from the JSON body (since Apps Script may not expose request headers) and never writes the secret to the sheet.
• Flatten and stabilize the server webhook payload so the sheet receives a consistent column set and optional/missing values are null or empty rather than causing errors.

Description

• Added docs/google-sheets-apps-script.js, a ready-to-copy Google Apps Script receiver that defines SHEET_NAME = "Submissions", a HEADERS array with the expected columns, safely parses JSON, validates data.secret against the WEBHOOK_SECRET script property, creates the Submissions sheet if missing, writes header row when row 1 is empty, maps fields in HEADERS order, and never appends the secret to the sheet.
• Updated the server-side webhook payload in lib/googleSheetsWebhook.ts to include receivedAt, memoryDistortionMagnitude, and rememberedPrimaryAttributionMatchesOriginal and to produce a stable flattened row (payload raw JSON is no longer appended).
• Updated documentation to point deployers to the new script and explain body-based secret validation in README.md and docs/VPS_DEPLOYMENT.md.
• Changed files: docs/google-sheets-apps-script.js, lib/googleSheetsWebhook.ts, README.md, and docs/VPS_DEPLOYMENT.md; the server sends the shared secret as secret in the JSON body and missing fields are sent as null or omitted consistently.

Testing

• Ran npm run typecheck and it completed successfully.
• Ran npm run lint and there were no ESLint warnings or errors.
• Ran npm run build and the production build completed successfully.

---

Codex Task