Add Google/Microsoft SSO OAuth for register and sign-in (#24) (#29)

## Summary
- Closes #24 (backend half)
- Add `OAuthIdentity` model (provider + `sub`, access/refresh tokens) for SSO now and Drive reuse later (#11)
- Endpoints: `GET /api/auth/oauth/<google|microsoft>/start/` and `/callback/`
- Create or link `CustomUser` by verified email; issue same JWT access/refresh; redirect FE to `/auth/callback/`
- Document `GOOGLE_OAUTH_*` / `MICROSOFT_OAUTH_*` / `OAUTH_CALLBACK_BASE_URL` in `.env.example` and `.env.prod.example`
- Expose configured providers on `GET /api/public/settings/` as `oauth.google` / `oauth.microsoft`

## Pair with
- Frontend PR: `chat_web_app` branch `feature/sso-oauth-24`

## Test plan
- [ ] `python manage.py test chat_backend.tests.test_oauth`
- [ ] With local Google/Microsoft client IDs set, complete start → IdP → callback → JWT redirect
- [ ] Existing password user with same email links identity (no duplicate)
- [ ] Unverified / missing email redirects with error code
- [ ] Registration disabled: signup start 403; login without account → `account_not_found`
- [ ] Secrets not committed; env examples onlyReviewed-on: #29

llm_be/chat_backend/admin.py

@@ -13,6 +13,7 @@ from .models import (
     Document,
     UserAuthEvent,
     OutboundEmail,
+    OAuthIdentity,
 )
 
 
@@ -232,3 +233,22 @@ admin.site.register(Feedback, FeedbackAdmin)
 
 admin.site.register(DocumentWorkspace, DocumentWorkspaceAdmin)
 admin.site.register(Document, DocumentAdmin)
+
+
+class OAuthIdentityAdmin(admin.ModelAdmin):
+    model = OAuthIdentity
+    list_display = (
+        "provider",
+        "email",
+        "subject",
+        "user",
+        "token_expires_at",
+        "created",
+        "last_modified",
+    )
+    list_filter = ("provider",)
+    search_fields = ("email", "subject", "user__email")
+    readonly_fields = ("created", "last_modified", "raw_profile")
+
+
+admin.site.register(OAuthIdentity, OAuthIdentityAdmin)