Social login: Sign in / sign up with Google (OAuth)

[JuansesDev]

Problem

Cloud signup today is password-based (Model B: password + email verification + 2FA + device step-up). Adding Sign in / Sign up with Google lowers signup friction for the cloud product, which is a common expectation for a hosted SaaS.

Scope

• Cloud only — like magic link, social login has no place in self-hosted instances. Lives in the private senddock-pro/internal/cloud behind the cloud build tag.
• Google OAuth 2.0 / OIDC: Sign in with Google button on the login and register screens.
• On callback: match by verified email to an existing user, or provision a new cloud user (email auto-verified, since Google already verified it).
• Coexist with the existing password flow — a user can have both. Decide linking rules (same email → link to existing account).

Notes

• Reuse the existing session issuance (IssueSession) once identity is established.
• 2FA still applies for accounts that have it enabled.
• Keep self-hosted binary untouched (build-tag separation, no Google deps leak into Core).