User accounts: support Google sign-in

# Problem

Many Galaxy users sign in to Galaxy with their Google account. BRC Analytics currently has no Google sign-in option, so these users cannot log in to BRC with the same identity they use on Galaxy. Beyond the inconvenience, this also risks a mismatch between a user's BRC identity and their Galaxy identity, which matters for the planned Galaxy integration (acting on the user's behalf, linking histories, etc. — see #1668).

# Proposed solution

Add "Sign in with Google" to the BRC Analytics login flow. Since Keycloak is our identity provider, this means enabling Google as an upstream identity provider in Keycloak so that:

- Users can authenticate to BRC with the same Google account they use for Galaxy.
- Accounts are matched/linked by verified email, so a user's BRC identity corresponds to their Galaxy identity.

# Acceptance criteria

- [ ] The login screen offers Google as a sign-in option.
- [ ] A user whose Galaxy account was created via Google can sign in to BRC with that same Google account.
- [ ] Signing in with Google resolves to the same BRC account as any existing email-based login for that address (no duplicate accounts).

Part of #1668.

Start with the Keycloak identity-provider configuration and the BRC Analytics login flow described in the issue. Check how existing email-based accounts are matched, then verify the Google sign-in path against the three acceptance criteria, including reuse of an existing BRC account and authentication with a Galaxy-created Google account.

Written by the indexing model from the issue text.