Improve login auth UX and Google OAuth setup

Branch: `codex/login-improvements`

## Scope
- Replace the existing GitHub OAuth CTA with Google OAuth on the login/signup page.
- Add client-side signup password validation so weak passwords are blocked before Supabase is called.
- Improve auth error handling so network, validation, and provider setup failures show actionable messages.
- Restyle forgot-password to match the current login theme and mobile layout.
- Add documentation for Supabase Google OAuth setup, redirect URLs, and troubleshooting.

## Acceptance criteria
- Login page uses `Continue with Google` and calls Supabase OAuth with `/auth/callback?next=/dashboard`.
- Signup does not submit when password requirements are not met.
- Forgot-password page visually matches the login theme and uses semantic Tailwind tokens.
- Docs explain Supabase Dashboard, Google Cloud OAuth, local/prod redirect URLs, and common errors.

Start at the login/signup and forgot-password pages, then trace the Supabase auth calls and the /auth/callback?next=/dashboard entry point. Review the existing auth UI and error handling before changing the Google OAuth flow, password validation, and semantic Tailwind styling. Done means the listed acceptance criteria pass and the Supabase and Google Cloud setup documentation covers local and production redirects and common errors.

Written by the indexing model from the issue text.