Add Google/Microsoft SSO buttons and OAuth callback flow (#24) (#41)

## Summary
- Frontend half of ai_ml_operations/chat_backend#24
- SSO buttons on Sign In / Sign Up (shown when `/public/settings/` reports provider configured)
- New `/auth/callback/` route stores JWTs, loads account, sends new SSO users through Stripe Checkout
- Error states for denied consent, unverified/missing email, link conflict, etc.
- README note on Capacitor / native redirect URI limits

## Pair with
- Backend PR: `chat_backend` branch `feature/sso-oauth-24`

## Test plan
- [ ] `npm test -- --watchAll=false --testPathPattern="SignIn.test|SignUp.test|AuthCallback.test"`
- [ ] With backend OAuth configured, Continue with Google/Microsoft from Sign In works
- [ ] First-time SSO register lands in Stripe Checkout when `needs_checkout=1`
- [ ] Existing linked user signs in and reaches app / TOS
- [ ] Error query (`email_unverified`, `access_denied`) shows message + back linkReviewed-on: #41

README.md

@@ -107,6 +107,18 @@ These are **baked into the JS at build time**. There is no host secret file for
 this frontend (unlike Django apps under `~/Documents/secrets/`). Change the
 committed `.env.*` files if API domains change, then redeploy.
 
+### SSO (Google / Microsoft)
+
+OAuth client IDs/secrets live in **chat_backend** env (`GOOGLE_OAUTH_*`,
+`MICROSOFT_OAUTH_*`). The SPA only redirects to
+`/api/auth/oauth/<provider>/start/` and lands on `/auth/callback/` with JWTs.
+SSO buttons appear when `/public/settings/` reports the provider as configured.
+
+**Capacitor / mobile:** IdP redirect URIs must match the backend callback URL
+(not the WebView origin). Custom URL schemes / in-app browser for native OAuth
+are out of scope for the initial web SSO; use the web app for Google/Microsoft
+sign-in until native redirect handling is added.
+
 Optional local overrides (gitignored): `.env.local`, `.env.development.local`,
 `.env.production.local`, `.env.mobile.local`.