feat(auth): sign in with Google behind NEXT_PUBLIC_GOOGLE_AUTH_ENABLED (#1441)

Adds a 'Continue with Google' button to login and register, gated by
NEXT_PUBLIC_GOOGLE_AUTH_ENABLED so it ships dark until the Google
provider is configured in Supabase. The OAuth round-trip reuses the
existing /auth/callback PKCE exchange, which already owns MFA routing,
invite acceptance and silent-team creation. A flow=oauth marker on the
redirect lets the callback tag failures (including provider consent
denials) so the login page shows Google-specific error copy instead of
the email-confirmation framing.

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/auth/google-oauth.ts

@@ -0,0 +1,13 @@
+/**
+ * Google OAuth feature flag.
+ *
+ * Signing in with Google requires the Google provider to be configured in
+ * Supabase (GoTrue) with a Google Cloud OAuth client; the flag ships the UI
+ * dark until that is done:
+ * https://supabase.com/docs/guides/auth/social-login/auth-google
+ * Unlike BankID this is not hosted-only: self-hosted installations can
+ * configure their own Google OAuth client.
+ */
+export function isGoogleAuthEnabled(): boolean {
+  return process.env.NEXT_PUBLIC_GOOGLE_AUTH_ENABLED === 'true'
+}