Add Google and Apple OAuth credentials

Google and Apple sign-in are built and dormant, waiting only on credentials.

What is already done

• config/services.ts carries google and apple blocks reading from env.
• The framework's socials package drives the OAuth exchange; /auth/{provider} and /auth/{provider}/callback mount automatically once a provider is configured.
• The account page renders buttons from configuredSocialProviders(), so a half-configured provider never reaches a visitor as a dead button. With no keys it says so plainly instead.
• STACKS_DEFAULT_ROUTES=auth mounts login, register, logout and refresh without dragging in the dashboard surface.

What you need to add

Google, from the Cloud console OAuth client:

GOOGLE_CLIENT_ID=… GOOGLE_CLIENT_SECRET=… GOOGLE_REDIRECT_URL=https://smakelo.stacksjs.com/auth/google/callback

Apple needs four values rather than two — a Services ID, plus the team, key and private key from the Apple developer portal:

APPLE_CLIENT_ID=… APPLE_TEAM_ID=… APPLE_KEY_ID=… APPLE_PRIVATE_KEY=… APPLE_REDIRECT_URL=https://smakelo.stacksjs.com/auth/apple/callback

Put them through buddy env:encrypt like the rest, since .env.production is committed encrypted.

One decision worth making deliberately. config.auth.socials.matching defaults to 'link': a provider identity whose email the provider has verified links to an existing local account. The takeover guard is not configurable — an unverified email never links — but 'create' (never match by email) is stricter still, at the cost of duplicate accounts for anyone who registered with a password first. For a demo 'link' is fine; worth knowing it is a choice.

Nothing else changes when the keys arrive: the buttons appear, and the existing find-or-create policy handles the rest.