omniauth-google-oauth2, omniauth-facebook, omniauth-github, omniauth-rails_csrf_protection. provider + uid columns on users. User.from_omniauth three-step lookup (uid match → email link → create). Users::OmniauthCallbacksController. OAuth buttons above email form on sign-in and registration pages. password_required? overridden for OAuth accounts. 11 new tests, 506 total green. ADR-0061. Secrets (GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, FACEBOOK_APP_ID, FACEBOOK_APP_SECRET, GITHUB_CLIENT_ID, GITHUB_CLIENT_SECRET) needed in .kamal/secrets before production deploy.
BL-068
Shipped