feat(auth): sign in with Google behind NEXT_PUBLIC_GOOGLE_AUTH_ENABLED (#1441)

Adds a 'Continue with Google' button to login and register, gated by
NEXT_PUBLIC_GOOGLE_AUTH_ENABLED so it ships dark until the Google
provider is configured in Supabase. The OAuth round-trip reuses the
existing /auth/callback PKCE exchange, which already owns MFA routing,
invite acceptance and silent-team creation. A flow=oauth marker on the
redirect lets the callback tag failures (including provider consent
denials) so the login page shows Google-specific error copy instead of
the email-confirmation framing.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -37,6 +37,12 @@ CRON_SECRET=generate-a-random-secret
 # Hosted keeps this unset: public signup stays open there.
 # AUTH_SIGNUPS_DISABLED=false
 
+# Sign in with Google. Requires the Google provider to be configured in
+# Supabase/GoTrue first (Google Cloud OAuth client + redirect URI):
+# https://supabase.com/docs/guides/auth/social-login/auth-google
+# The button stays hidden until this is true.
+# NEXT_PUBLIC_GOOGLE_AUTH_ENABLED=true
+
 # ── Optional: extension features (core runs without these) ─
 # AI features: Claude via AWS Bedrock (document extraction + AI assistant).
 # Needs an AWS account with Bedrock model access to Claude. Plain