Add Google/Microsoft SSO buttons and OAuth callback flow (#24)

Wire Sign In/Sign Up to backend OAuth start, handle /auth/callback/ JWT
return (including Stripe checkout for new SSO accounts), and document
Capacitor redirect limits.

README.md

@@ -107,6 +107,18 @@ These are **baked into the JS at build time**. There is no host secret file for
 this frontend (unlike Django apps under `~/Documents/secrets/`). Change the
 committed `.env.*` files if API domains change, then redeploy.
 
+### SSO (Google / Microsoft)
+
+OAuth client IDs/secrets live in **chat_backend** env (`GOOGLE_OAUTH_*`,
+`MICROSOFT_OAUTH_*`). The SPA only redirects to
+`/api/auth/oauth/<provider>/start/` and lands on `/auth/callback/` with JWTs.
+SSO buttons appear when `/public/settings/` reports the provider as configured.
+
+**Capacitor / mobile:** IdP redirect URIs must match the backend callback URL
+(not the WebView origin). Custom URL schemes / in-app browser for native OAuth
+are out of scope for the initial web SSO; use the web app for Google/Microsoft
+sign-in until native redirect handling is added.
+
 Optional local overrides (gitignored): `.env.local`, `.env.development.local`,
 `.env.production.local`, `.env.mobile.local`.