Adds api/app/auth/oauth_providers.py with GoogleOAuthProvider (httpx-based,
no authlib needed) and generate_pkce_pair(). New routes:
GET /auth/oauth/{provider}/authorize and POST /auth/oauth/{provider}/callback
with state/PKCE validation and three-way user resolution (existing OAuth link,
email auto-link, new social-only user). Updates settings.py with
GOOGLE_AUTH_CLIENT_ID/SECRET and OAUTH_REDIRECT_URI.
Also includes Step 1 backend changes (already marked complete in plan):
oauth_accounts table migration, nullable password_hash, avatar_url on User.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
