feat(auth): gate OAuth buttons on login behind config flags

GitHub/Google buttons on the login page pointed at providers that may
not be configured in Supabase, dead-ending in an error. Add
NEXT_PUBLIC_OAUTH_GITHUB / NEXT_PUBLIC_OAUTH_GOOGLE (opt-in, "true" to
show); a provider button renders only when enabled and the whole social
block is hidden when neither is. Pure resolveOAuthProviders helper is
unit-tested; flags documented in .env.example and DEPLOYMENT.md.

__tests__/auth-config.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect } from 'vitest'
+import { resolveOAuthProviders, anyOAuthProvider } from '@/lib/auth-config'
+
+describe('resolveOAuthProviders', () => {
+  it('enables a provider only when its flag is exactly "true"', () => {
+    expect(resolveOAuthProviders({ github: 'true', google: 'true' })).toEqual({
+      github: true,
+      google: true,
+    })
+  })
+
+  it('treats unset / empty / other values as disabled', () => {
+    expect(resolveOAuthProviders({})).toEqual({ github: false, google: false })
+    expect(resolveOAuthProviders({ github: '', google: 'false' })).toEqual({
+      github: false,
+      google: false,
+    })
+    expect(resolveOAuthProviders({ github: 'TRUE', google: '1' })).toEqual({
+      github: false,
+      google: false,
+    })
+  })
+
+  it('resolves each provider independently', () => {
+    expect(resolveOAuthProviders({ github: 'true' })).toEqual({
+      github: true,
+      google: false,
+    })
+  })
+})
+
+describe('anyOAuthProvider', () => {
+  it('is false when no provider is enabled', () => {
+    expect(anyOAuthProvider({ github: false, google: false })).toBe(false)
+  })
+
+  it('is true when at least one provider is enabled', () => {
+    expect(anyOAuthProvider({ github: true, google: false })).toBe(true)
+    expect(anyOAuthProvider({ github: false, google: true })).toBe(true)
+  })
+})