feat(auth): add "Continue with Google" OAuth 2.0 login

Server-side authorization-code flow: /v1/auth/google redirects to the
consent screen with a CSRF state cookie; /v1/auth/google/callback
exchanges the code, validates the ID token (iss/aud/exp/email_verified),
and mints a 30-day session via upsertOAuthLogin. /v1/auth/providers lets
the login UI hide the button until GOOGLE_OAUTH_ID/SECRET are set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -15,6 +15,17 @@ NEXT_PUBLIC_API_URL=http://localhost:4000
 GITHUB_OAUTH_ID=
 GITHUB_OAUTH_SECRET=
 
+# ---- Google OAuth (optional — "Continue with Google") ----
+# Create at https://console.cloud.google.com/apis/credentials
+# Authorized redirect URI must be: <CONTROL_PLANE_PUBLIC_URL>/v1/auth/google/callback
+# e.g. dev:  http://localhost:4000/v1/auth/google/callback
+#      prod: https://api.buildmymcp.com/v1/auth/google/callback
+GOOGLE_OAUTH_ID=
+GOOGLE_OAUTH_SECRET=
+
+# Public URL of this API, used to build the OAuth redirect URI.
+CONTROL_PLANE_PUBLIC_URL=http://localhost:4000
+
 # ---- Anthropic ----
 ANTHROPIC_API_KEY=