Add test/staging OAuth redirect URIs to Google Cloud Console

[rdhyee]

When using Google OAuth login on test.unglue.it, Google returns redirect_uri_mismatch because only unglue.it is registered.

Need to add to the Google Cloud OAuth app's authorized redirect URIs:

• https://test.unglue.it/socialauth/complete/google-oauth2/
• https://staging.unglue.it/socialauth/complete/google-oauth2/ (for later)

Requires access to the Google Cloud project that owns the social_auth_google_oauth2_key.

Workaround: Use direct Django login (createsuperuser) for testing.

[rdhyee]

Bumping — this came up concretely on 2026-05-07. Sign-in on dj42/test fails with redirect_uri_mismatch because both hosts use prod's Google OAuth client, which only has prod redirect URIs registered.

Two paths forward:

1. Quick (Eric self-serves): Eric adds these two redirect URIs to the existing OAuth client in GCP project 569579163337:
   • https://dj42.unglue.it/socialauth/complete/google-oauth2/
   • https://test.unglue.it/socialauth/complete/google-oauth2/
2. Proper (closes security-private#16 item 4): Eric grants Raymond Editor on GCP project 569579163337, then Raymond creates a separate "unglue.it staging" OAuth client and rotates test+dj42 vault values.

Awaiting Eric's call in today's meeting (agenda: ~/obsidian/Main/2026-05-07 Eric Meeting Agenda.md).

[rdhyee]

Closing — superseded by a different approach. Rather than adding test/dj42 redirect URIs to the existing prod OAuth client (which would have required access to prod GCP project 569579163337), we created a separate OAuth client in a new GCP project owned by `unglueit@ebookfoundation.org`.

• regluit-provisioning#34 — vault rotation to the new client
• Fix auth_logout URL name in templates (Django 4.2) Gluejar/regluit#1145 — Django 4.2 `auth_logout` URL name fix surfaced during smoke-test
• EbookFoundation/security-private#16 (item 4) — context + summary

Prod OAuth client untouched. Prod access conversation continues in EbookFoundation/security-private#17.