Add social login unit tests and regression verification

## Context
Social login is implemented, but the plan still calls for AuthService unit tests and verification that existing auth flows continue to work after Apple and Google sign-in.

## Scope
- Add unit tests for `AuthService.loginWithApple()` and `loginWithGoogle()` using a mock API client.
- Verify email/password login still works.
- Verify token refresh, logout, and session restore after social login.
- Capture any required physical-device-only checks in the plan or docs.

## Acceptance criteria
- AuthService social login success and failure paths are covered by tests.
- Existing email/password auth behavior is verified.
- Token lifecycle behavior after social login is explicitly tested or documented.