fix(auth): enable Google OAuth + expand redirect allowlist (#196)

- Enable Google OAuth provider in Supabase cloud (config.toml + push)
- Allowlist: localhost, default Vercel, branch glob, bare prod custom domain
- Dedup redundant git-main entry (covered by glob wildcard)

Fixes ERR_CONNECTION_REFUSED OAuth loop: Vercel NEXT_PUBLIC_APP_URL was empty,
causing callbackUrl() to fall back to localhost site_url — Supabase rejected
the redirect and dropped users on localhost root with ?code= in query.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: EmiyaKiritsugu3

supabase/config.toml

@@ -155,6 +155,7 @@ site_url = "http://localhost:3000"
 # A list of *exact* URLs that auth providers are permitted to redirect to post authentication.
 additional_redirect_urls = [
   "http://localhost:3000/auth/callback",
+  "https://smartmanagementsystem-emiyakiritsugu3s-projects.vercel.app/auth/callback",
   "https://smartmanagementsystem-*-emiyakiritsugu3s-projects.vercel.app/auth/callback",
   "https://smartmanagementsystem.vercel.app/auth/callback"
 ]
@@ -313,6 +314,12 @@ max_frequency = "5s"
 # Use an external OAuth provider. The full list of providers are: `apple`, `azure`, `bitbucket`,
 # `discord`, `facebook`, `github`, `gitlab`, `google`, `keycloak`, `linkedin_oidc`, `notion`, `twitch`,
 # `twitter`, `x`, `slack`, `spotify`, `workos`, `zoom`.
+[auth.external.google]
+enabled = true
+client_id = "687532012962-b0q21ukr717vvnhnn45ecif23nehvq0q.apps.googleusercontent.com"
+secret = "env(SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET)"
+skip_nonce_check = false
+
 [auth.external.apple]
 enabled = false
 client_id = ""