Account being used (for logging, debugging)
Mints access tokens for this account. Pass it to a Google API client with
attachTokenProvider; this package does not build the client itself.
GUARANTEED to exist when handler runs
OptionalmetadataAdditional metadata (e.g., service account email)
Auth context injected into extra by middleware