feat(auth): add "Continue with Google" OAuth 2.0 login

Server-side authorization-code flow: /v1/auth/google redirects to the
consent screen with a CSRF state cookie; /v1/auth/google/callback
exchanges the code, validates the ID token (iss/aud/exp/email_verified),
and mints a 30-day session via upsertOAuthLogin. /v1/auth/providers lets
the login UI hide the button until GOOGLE_OAUTH_ID/SECRET are set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/lib/api.ts

@@ -1,9 +1,6 @@
 const API_BASE = process.env.NEXT_PUBLIC_API_URL ?? 'http://localhost:4000';
 
-export async function apiFetch<T = unknown>(
-  path: string,
-  init: RequestInit = {},
-): Promise<T> {
+export async function apiFetch<T = unknown>(path: string, init: RequestInit = {}): Promise<T> {
   const res = await fetch(`${API_BASE}${path}`, {
     credentials: 'include',
     cache: 'no-store',
@@ -26,6 +23,11 @@ export async function apiFetch<T = unknown>(
   return (await res.json()) as T;
 }
 
+/** Absolute API URL for a path — use for full-page navigations (OAuth redirects). */
+export function apiUrl(path: string): string {
+  return `${API_BASE}${path}`;
+}
+
 export function apiWebSocketURL(path: string): string {
   const httpBase = API_BASE;
   const wsBase = httpBase.replace(/^http/, 'ws');