feat(auth): start Google OIDC login

[rd-code-23]

Summary

• add Google OIDC discovery through openid-client
• add GET /auth/google to begin Authorization Code Flow
• generate and persist per-attempt state, nonce, and PKCE values
• request only the required openid email profile scopes
• validate post-login destinations as safe root-relative application paths
• add focused redirect and security tests without introducing test-only product endpoints

Why

The API needs a standards-compliant, protected login initiation flow before it can validate Google callbacks and create authenticated users.

Validation

• pnpm --filter @goforlift/api test — 28 tests passed
• pnpm --filter @goforlift/api typecheck
• pnpm --filter @goforlift/api lint
• pnpm --filter @goforlift/api build
• targeted Prettier checks
• git diff --check

Closes #8