fix(auth): fail startup when Google/GitHub OAuth client secret is missing

[pedrofrxncx]

Source: hardening gap in apps/api/src/auth/auth-env.ts (this session's "auth scopes validation" focus area) — the wildcard-scope gap in the same directory is already covered by open PR #5021, so this targets a distinct, un-covered validation hole in the same file.

Why a maintainer wants this: authEnvSchema already fails startup when Microsoft SSO, Google SSO, or an email-provider reference is half-configured (client ID set, secret missing) — but the plain social-login providers (AUTH_GOOGLE_CLIENT_ID/AUTH_GITHUB_CLIENT_ID) had no matching check. Setting just the client ID (a typo'd or partially-copied .env) silently produced a socialProviders.google/github config with clientSecret: "" instead of failing fast — the exact inconsistency the SSO checks already exist to prevent for the other providers.

Failure scenario: deploy with AUTH_GOOGLE_CLIENT_ID set but AUTH_GOOGLE_CLIENT_SECRET unset (e.g. an incomplete secret-manager sync) → server boots fine, Better Auth registers the Google provider with an empty secret, and Google OAuth login fails confusingly at request time instead of at startup where it's obvious. Same for GitHub.

Fix: two superRefine checks mirroring the existing SSO pattern — reject at config-parse time (which runs at server boot via getConfig() → loadAuthConfig()) when a client ID is set without its secret. Added a regression test per provider (accept-when-complete + reject-when-incomplete), inverting-style tests matching the existing SSO test shape in the same file.

Reviewer check: bun test apps/api/src/auth/auth-env.test.ts

Locally verified: bun run fmt, cd apps/api && bunx tsc --noEmit, bun test apps/api/src/auth/auth-env.test.ts (14 pass), bunx oxlint apps/api/src/auth/auth-env.ts apps/api/src/auth/auth-env.test.ts (0 warnings/errors). Full CI validates the rest.

---

Summary by cubic

Fail startup when Google/GitHub OAuth client secrets are missing to surface misconfigurations early and prevent runtime login failures. Aligns social-login validation with existing SSO checks.

• Bug Fixes
  • Added superRefine checks in apps/api/src/auth/auth-env.ts to require AUTH_GOOGLE_CLIENT_SECRET and AUTH_GITHUB_CLIENT_SECRET when their client IDs are set.
  • Added tests in apps/api/src/auth/auth-env.test.ts for accept/reject cases on Google and GitHub OAuth.

^{Written for commit b75e2de. Summary will update on new commits.}