Implement OAuth 2.0 Social Login Flow

Implement a complete OAuth 2.0 social login system supporting multiple providers. Include:

**Backend:**
- OAuth callback handler with PKCE for SPAs
- Provider abstraction: Google, GitHub, Microsoft, Apple
- Token exchange and user profile fetching
- Account linking when email matches existing user
- New user registration from OAuth profile
- Session creation and JWT issuance
- CSRF protection with state parameter
- Nonce validation for OpenID Connect providers

**Frontend:**
- Login button components for each provider with official branding
- Popup-based OAuth flow (no full page redirect)
- Post-login redirect to original destination
- Loading state during token exchange
- Error handling for denied permissions, expired states

**Database:**
- User accounts table with provider-specific fields
- OAuth tokens table for refresh token storage
- Account linking table for multi-provider users

Use the existing auth framework in this project if present.