ApiKeyGoogleAuth

Build and throw a standardised Google request error. Both the !res.ok path (native fetch) and the catch path (gaxios) funnel through here so the caller always sees the same shape.