feat: login with Google

[ronjalh]

Summary

Coaches can log in with Google: login(googleToken) checks the token with Google and starts a session. Closes #70 (the session part is #82).

Draft on purpose. Sign in with Google only allows http on localhost. The course VM (http://it2810-27.idi.ntnu.no/project2/) has only http, so this does not work there, and the team has to decide how the login should work on the server before this is merged. It works locally. Everything that does not need Google (the tokens, me, refreshSession, logout) is in #82 and does not wait for this.

Stacked on #82 (the session). The base is 70-session-tokens. Change the base to dev when the others are merged.

What's in it

• auth/google.ts: checks the Google ID token with google-auth-library (signature, expiry, issuer, aud = GOOGLE_CLIENT_ID, verified email). The token is never stored.
• login(googleToken): creates the coach on the first login from sub (googleId), email and name, keeps the name and email up to date, and returns the tokens from feat: add access tokens and rotating refresh tokens #82 and the coach. A bad token gives UNAUTHENTICATED without saying why. Without GOOGLE_CLIENT_ID it answers NOT_IMPLEMENTED.
• Settings: GOOGLE_CLIENT_ID (turns the login on). The server does not start with a client id and no SESSION_SECRET.
• The test version of Google is a fake that is passed to the app (verifyGoogleToken).
• Docs: how to get a Google client id and try the login (README), docs/API.md, backend/.env.example, docs/AI_USAGE.md.

Testing

• Lint, tsc --noEmit and 160 tests pass against a database (0 skipped); 8 are new (login.test.ts): the first login creates the coach and the next one finds it, the name and email are kept up to date, a wrong or expired Google token gives UNAUTHENTICATED without saying why, login is off without a client id, expired sessions are removed, the tokens from login work, and login over HTTP.
• Not tested: the real Google check (needs a client id and a real Google token).

🤖 Generated with Claude Code

[ronjalh]

Tror dette egentlig krever https på vm noe vi ikke har så må tenke litt gjennom det