feat(auth): expose OAuth provider config and conditionally show sign-in options

[albegosu]

Summary

• Add GET /api/config/auth-providers to expose which OAuth providers (Google, GitHub) are configured via env vars — without leaking secrets.
• Update sign-in and sign-up pages to fetch provider config on mount and only show OAuth buttons (and the "or" divider) when at least one provider is available.
• Enable OAuth on sign-in (previously disabled "coming soon" placeholders) when providers are configured.
• Harden decryptSecret to return null on corrupted ciphertext instead of an empty string, with safer fallbacks in settings resolution.
• Add unit tests for auth providers config, admin auth, rate limiting, session handling, and corrupted secret decryption.
• Expand Vitest coverage to include server/middleware/** and raise coverage thresholds.

Test plan

• Start app with no GOOGLE_* / GITHUB_* env vars → sign-in and sign-up show email/password only (no OAuth section).
• Set GOOGLE_CLIENT_ID + GOOGLE_CLIENT_SECRET → Google button appears on sign-in and sign-up; GitHub stays hidden.
• Set all four OAuth env vars → both Google and GitHub buttons appear.
• Click OAuth buttons → redirect flow starts (loading state shows …).
• GET /api/config/auth-providers returns { google: boolean, github: boolean } and never exposes secrets.
• Run npm test (or your project test command) — all new specs pass.
• Verify settings with encrypted values still resolve correctly after decryptSecret change.