Index: src/routes/account.js
===================================================================
--- src/routes/account.js	(revision 7881080819a21d5ba5da32d94ef51da0d866eea0)
+++ src/routes/account.js	(revision f33b24ac58be5fa1644afcf1cf2941d76df8feaa)
@@ -24,4 +24,5 @@
 import { renderPage } from '../middleware/render.js';
 import { requireAuth } from '../middleware/auth.js';
+import { googleConfigured } from '../config/google.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -58,9 +59,10 @@
 router.get('/', requireAuth, (req, res) => {
   const account = db.prepare(`
-    SELECT id, username, email, role, bio, avatar_url, created_at, password_hash
+    SELECT id, username, email, role, bio, avatar_url, created_at, password_hash, google_sub
     FROM users WHERE id = ?
   `).get(req.session.user.id);
   const hasPassword = !!(account && account.password_hash && account.password_hash !== '!google-oauth');
-  if (account) delete account.password_hash; // niet naar de view lekken
+  const googleLinked = !!(account && account.google_sub);
+  if (account) { delete account.password_hash; delete account.google_sub; } // niet naar de view lekken
 
   renderPage(req, res, 'pages/account', {
@@ -69,4 +71,6 @@
     account,
     hasPassword,
+    googleLinked,
+    googleAvailable: googleConfigured(),
     editableSite: ownedSite(req.session.user),
     success: req.query.success || null,
@@ -144,4 +148,18 @@
 });
 
+// Google-account ontkoppelen. Alleen toegestaan als er nog een wachtwoord is,
+// anders zou je jezelf buitensluiten (geen login-methode meer over).
+router.post('/google/unlink', requireAuth, (req, res) => {
+  const row = db.prepare('SELECT password_hash, google_sub FROM users WHERE id = ?').get(req.session.user.id);
+  if (!row || !row.google_sub) {
+    return res.redirect('/account?error=' + encodeURIComponent('Er is geen Google-account gekoppeld'));
+  }
+  if (!row.password_hash || row.password_hash === '!google-oauth') {
+    return res.redirect('/account?error=' + encodeURIComponent('Stel eerst een wachtwoord in — anders kun je niet meer inloggen.'));
+  }
+  db.prepare('UPDATE users SET google_sub = NULL, updated_at = CURRENT_TIMESTAMP WHERE id = ?').run(req.session.user.id);
+  res.redirect('/account?success=' + encodeURIComponent('Google-account ontkoppeld'));
+});
+
 // ==================== UPLOAD AVATAR ====================
 router.post('/avatar', requireAuth, (req, res) => {