Google sign-in. The sign-in popover now leads with "Continue with
Google" (email + 6-digit code remains below an "or" divider). Uses Supabase
OAuth with the PKCE flow: signInWithGoogle() in lib/auth.tsx redirects
through Google's consent screen and lands on the existing /auth/confirm
route, which already exchanged PKCE codes for a session cookie. A failed or
cancelled OAuth round-trip now shows its own toast instead of the misleading
"sign-in link was invalid" message.
