1ToolRing supports Google and GitHub OAuth for account creation and sign-in.

## Flow

1. The dashboard links to `/auth/google` or `/auth/github` on the API host.
2. The provider authorizes and redirects back to `/auth/{provider}/callback` on the API host.
3. The backend validates the state, fetches the verified profile, upserts the user, and redirects to the dashboard with a JWT in the URL fragment:

```text
https://app.1toolring.com/oauth/callback#token=<jwt>
```

## Requirements

- Google: the account must return a verified email.
- GitHub: the user must have a primary verified email and grant the `read:user user:email` scope.

## Security

- The OAuth state is a signed cookie (`HttpOnly`, `Secure`, `SameSite=Lax`, 10-minute TTL).
- A new OAuth user is created with `email_verified = true`, so the signup bonus is granted at creation.
- Suspended accounts are rejected at login.