feat(auth): enable GitHub + Google OAuth for v0.1.0 public launch

BetterAuth social providers (GitHub, Google, Apple) were already wired
on the server side at packages/auth/src/server.ts. Env vars
GITHUB_CLIENT_ID/SECRET + GOOGLE_CLIENT_ID/SECRET already present in
.env.example + .env.production.template. The SocialProviders component
at apps/web/src/modules/auth/form/social-providers.tsx already renders
the buttons.

The only missing piece was trimming the provider list — we had Apple in
config/auth.ts but no plan to ship Apple for v0.1.0. Drop it.

Add docs/oauth-setup.md with step-by-step wiring for:
- GitHub OAuth app (Homepage + callback URLs)
- Google OAuth client (authorized origins + redirect URIs)
- Production env propagation
- Troubleshooting (redirect_uri_mismatch, invalid_client, etc)

User action required: create the GitHub OAuth app + add claudemesh.com
redirect to the existing Google OAuth client in GCP project
surfquant-490521, then populate the 4 env vars in production.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

apps/web/src/config/auth.ts

@@ -18,6 +18,7 @@ export const authConfig = authConfigSchema.parse({
     magicLink: toBool(env.NEXT_PUBLIC_AUTH_MAGIC_LINK, false),
     passkey: toBool(env.NEXT_PUBLIC_AUTH_PASSKEY, true),
     anonymous: toBool(env.NEXT_PUBLIC_AUTH_ANONYMOUS, true),
-    oAuth: [SocialProvider.APPLE, SocialProvider.GOOGLE, SocialProvider.GITHUB],
+    // v0.1.0: GitHub + Google. Apple deferred until we need it.
+    oAuth: [SocialProvider.GOOGLE, SocialProvider.GITHUB],
   },
 }) satisfies AuthConfig;