SSO stays hidden until configured

Google/Apple buttons stay off until AUTH_GOOGLE_* / AUTH_APPLE_* exist. Never fake SSO.

GET /api/v1/auth/sso reports which providers are configured. Buttons stay hidden and OAuth APIs return 501 until host secrets exist.

Do not mint AUTH_GOOGLE_ID, AUTH_APPLE_ID, or a fake id-token 200 on this page.