feat(auth): gate OAuth buttons on login behind config flags

GitHub/Google buttons on the login page pointed at providers that may
not be configured in Supabase, dead-ending in an error. Add
NEXT_PUBLIC_OAUTH_GITHUB / NEXT_PUBLIC_OAUTH_GOOGLE (opt-in, "true" to
show); a provider button renders only when enabled and the whole social
block is hidden when neither is. Pure resolveOAuthProviders helper is
unit-tested; flags documented in .env.example and DEPLOYMENT.md.

.env.example

@@ -24,6 +24,14 @@ NEXT_PUBLIC_APP_URL=http://localhost:3000
 # Rotating this key invalidates all existing ciphertexts; re-enter each secret.
 SECRETS_ENCRYPTION_KEY=
 
+# OAuth provider buttons on the login page (optional).
+# Set to "true" only for a provider you have actually configured in Supabase
+# Auth. Unset/anything-else hides that button (an unconfigured provider button
+# just dead-ends in a Supabase error). If neither is "true" the whole
+# "OR / social sign-in" block is hidden.
+NEXT_PUBLIC_OAUTH_GITHUB=
+NEXT_PUBLIC_OAUTH_GOOGLE=
+
 # Node env (optional, defaults to "development" locally)
 NODE_ENV=development