Gmail is not authorized — complete OAuth (Admin → Settings → Email)
Outbound mail check (assertSiteMailConfigured / health) while mode is Gmail found client credentials but no refresh token. Message points to Admin → Settings → Email.
Why this happens
Admin entered OAuth client ID/secret (and Google account email) but never finished Connect Google, or Disconnect cleared the refresh token. Sibling without the Admin path appears when sending actually builds the Gmail transport.
Diagnose and fix
1. Admin → Settings → Email — mode Gmail; fill client ID/secret and Google account email.
2. Click Connect Google / complete consent; confirm refresh token is stored.
3. Send a test message; see Gmail XOAUTH2.
4. If consent exists but send still fails, check mail-scope reconnect guidance in product errors.