Syncing Gmail with mbsync using OAuth2

I wholeheartedly dislike GMail (ethically, technically, and UX), and for my personal email I have always run my own server. But for work email I don&rsquo;t have a choice. I am using isync/mbsync to make it usable for me and mutt. Until now I&rsquo;ve used a Google app password to authenticate, but they are a security nightmare. OAuth2 is a better way. Sadly the interwebs have only scarce,…