feat: add Sign In with Google

Adds Google OAuth alongside existing Apple and email/password auth. Follows the same patterns as Apple Sign-In: state cookie for CSRF, anonymousId migration, and user linking by email. Key differences: Google callback is a GET redirect (sameSite: lax) and uses a static client secret instead of a signed JWT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

drizzle/meta/_journal.json

@@ -22,6 +22,13 @@
       "when": 1770961427714,
       "tag": "0002_outstanding_hiroim",
       "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1774416309647,
+      "tag": "0003_overjoyed_mindworm",
+      "breakpoints": true
     }
   ]
 }