feat(auth): base available login methods off GoTrue providers (#1869)

* feat(auth): base login fields on GoTrue providers

Signed-off-by: Goostaf <gasplund2@gmail.com>

# Conflicts:
#	app/(auth)/login/login-client.tsx
#	app/(auth)/register/page.tsx

* fix: address feedback

Signed-off-by: Goostaf <gasplund2@gmail.com>

* chore: remove hardcoded Google enabled checks

Signed-off-by: Goostaf <gasplund2@gmail.com>

# Conflicts:
#	.env.example

* feat: show label when password login is disabled

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: use MicrosoftMark, correct comment

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: display custom providers

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: show when no methods are available

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: display custom provider labels

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: add SAML login path

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: show when no methods are available

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: display SAML button when enabled

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: preserve nextPath and broken key

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: redirect test to client

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: expose registerEnabled

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: provider allowlist and request timeout

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: restore compact labels

Signed-off-by: Goostaf <gasplund2@gmail.com>

* refactor: move withTimeout implementation to utils

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: include nextPath

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix: export function and test case

Signed-off-by: Goostaf <gasplund2@gmail.com>

* feat: only show SAML button if vars configured

Signed-off-by: Goostaf <gasplund2@gmail.com>

* fix(auth): map SAML sign-in error through getErrorMessage

The antipattern ratchet (check:guards, raw-user-error) rejects a raw
error.message reaching a user-visible sink. Route the signInWithSSO
error through getErrorMessage like the other auth error paths.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013BAzJjXQBa9F5L1U42wUMj
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>

* feat(auth): GitHub brand mark on the provider button; decision log

GitHub allows its invertocat in solid black/white, so currentColor is
correct; custom OIDC providers keep the generic key icon.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013BAzJjXQBa9F5L1U42wUMj
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>

---------

Signed-off-by: Goostaf <gasplund2@gmail.com>
Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -61,12 +61,6 @@ RECEIPT_HUNT_COMPANY_IDS=
 # Hosted keeps this unset: public signup stays open there.
 # AUTH_SIGNUPS_DISABLED=false
 
-# Sign in with Google. Requires the Google provider to be configured in
-# Supabase/GoTrue first (Google Cloud OAuth client + redirect URI):
-# https://supabase.com/docs/guides/auth/social-login/auth-google
-# The button stays hidden until this is true.
-# NEXT_PUBLIC_GOOGLE_AUTH_ENABLED=true
-
 # Cloudflare Turnstile site key for Supabase Auth bot protection. This value is
 # public and is embedded in the browser bundle. Leave it unset until a widget
 # has been created for the deployment's exact hostnames. Deploy the site key
@@ -74,6 +68,12 @@ RECEIPT_HUNT_COMPANY_IDS=
 # existing login flow remains available throughout rollout.
 # NEXT_PUBLIC_TURNSTILE_SITE_KEY=
 
+# SAML SSO login (Enterprise). When enabled in Supabase GoTrue (saml_enabled),
+# the login page shows a SAML button. At least one of these is required to
+# tell Supabase which identity provider to redirect to:
+# NEXT_PUBLIC_SSO_DOMAIN=your-domain.okta.com   # discovers the provider by IdP domain
+# NEXT_PUBLIC_SSO_PROVIDER_ID=                   # explicit provider uuid (overrides domain)
+
 # ── Optional: extension features (core runs without these) ─
 # AI features (document extraction + AI assistant). Three ways to provide a
 # backend; set one of them. AI_PROVIDER (bedrock|anthropic|openai-compatible)