Add Google/Microsoft SSO OAuth for register and sign-in (#24)

Introduce OAuthIdentity storage, start/callback endpoints, JWT handoff to
the SPA, and mocked IdP tests so Drive OAuth (#11) can reuse the same model.

.env.example

@@ -28,6 +28,18 @@ CAPTCHA_SECRET_KEY=
 # Self-serve sign-up (default false — set true to allow /user/create/)
 ENABLE_ACCOUNT_REGISTRATION=false
 
+# OAuth SSO — Google / Microsoft (#24). Leave blank to hide SSO buttons.
+# Redirect URIs (register in each IdP console):
+#   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/google/callback/
+#   {OAUTH_CALLBACK_BASE_URL}/api/auth/oauth/microsoft/callback/
+GOOGLE_OAUTH_CLIENT_ID=
+GOOGLE_OAUTH_CLIENT_SECRET=
+MICROSOFT_OAUTH_CLIENT_ID=
+MICROSOFT_OAUTH_CLIENT_SECRET=
+MICROSOFT_OAUTH_TENANT=common
+# Optional; defaults to request host. Example local: http://127.0.0.1:8001
+OAUTH_CALLBACK_BASE_URL=http://127.0.0.1:8001
+
 # Stripe / finance (optional local — required for checkout + webhooks)
 STRIPE_SECRET_KEY=
 STRIPE_PUBLISHABLE_KEY=