Add Google/Microsoft SSO OAuth for register and sign-in (#24) (#29)

## Summary
- Closes #24 (backend half)
- Add `OAuthIdentity` model (provider + `sub`, access/refresh tokens) for SSO now and Drive reuse later (#11)
- Endpoints: `GET /api/auth/oauth/<google|microsoft>/start/` and `/callback/`
- Create or link `CustomUser` by verified email; issue same JWT access/refresh; redirect FE to `/auth/callback/`
- Document `GOOGLE_OAUTH_*` / `MICROSOFT_OAUTH_*` / `OAUTH_CALLBACK_BASE_URL` in `.env.example` and `.env.prod.example`
- Expose configured providers on `GET /api/public/settings/` as `oauth.google` / `oauth.microsoft`

## Pair with
- Frontend PR: `chat_web_app` branch `feature/sso-oauth-24`

## Test plan
- [ ] `python manage.py test chat_backend.tests.test_oauth`
- [ ] With local Google/Microsoft client IDs set, complete start → IdP → callback → JWT redirect
- [ ] Existing password user with same email links identity (no duplicate)
- [ ] Unverified / missing email redirects with error code
- [ ] Registration disabled: signup start 403; login without account → `account_not_found`
- [ ] Secrets not committed; env examples onlyReviewed-on: #29

llm_be/chat_backend/models.py

@@ -162,6 +162,47 @@ class OutboundEmail(models.Model):
         return f"{self.subject} → {self.to_email} ({self.status})"
 
 
+class OAuthIdentity(TimeInfoBase):
+    """Linked IdP identity + tokens (SSO now; Drive OAuth reuse later — #11)."""
+
+    class Provider(models.TextChoices):
+        GOOGLE = "google", "Google"
+        MICROSOFT = "microsoft", "Microsoft"
+
+    user = models.ForeignKey(
+        CustomUser,
+        on_delete=models.CASCADE,
+        related_name="oauth_identities",
+    )
+    provider = models.CharField(max_length=32, choices=Provider.choices)
+    subject = models.CharField(
+        max_length=255,
+        help_text="OIDC subject (sub) from the identity provider",
+    )
+    email = models.EmailField(blank=True, default="")
+    access_token = models.TextField(blank=True, default="")
+    refresh_token = models.TextField(blank=True, default="")
+    token_expires_at = models.DateTimeField(null=True, blank=True)
+    scopes = models.TextField(blank=True, default="")
+    raw_profile = models.JSONField(default=dict, blank=True)
+
+    class Meta:
+        constraints = [
+            models.UniqueConstraint(
+                fields=["provider", "subject"],
+                name="uniq_oauth_provider_subject",
+            ),
+            models.UniqueConstraint(
+                fields=["provider", "user"],
+                name="uniq_oauth_provider_user",
+            ),
+        ]
+        verbose_name_plural = "OAuth identities"
+
+    def __str__(self):
+        return f"{self.provider}:{self.subject} → {self.user_id}"
+
+
 FEEDBACK_CHOICE = (
     ("SUBMITTED", "Submitted"),
     ("RESOLVED", "Resolved"),