feat(auth): B-2.4 OAuth Microsoft/Google + magic link (Loi 25 deferred consent)

Adds Microsoft 365 + Google OAuth providers (separate from the existing
generic OIDC SSO at src/auth/sso.py) and a passwordless magic-link login
flow. New OAuth signups capture Loi 25 art. 14 consents (4 granular
checkboxes) BEFORE creating the User row via /auth/oauth/finish-signup.

Per compatibility-audit.md C2:
- No src/auth_extended/ directory — extends src/auth/ in place
- No new User columns — reuses sso_provider/sso_subject + email_verified
- Magic-link tokens via itsdangerous URLSafeTimedSerializer (15-min, no DB)
- All routes added to existing auth_bp; templates extend marketing/base.html
- Anti-enumeration on /auth/magic-link (generic flash for unknown OR
  unverified emails) and /auth/magic-link/<token> (same flash for
  invalid/expired/unverified-user)

Files added:
- src/auth/oauth_providers.py — Microsoft + Google OAuth registration,
  is_oauth_provider_enabled(), find_user_by_oauth(), create_oauth_user_with_consent()
- src/auth/magic_link.py — generate/consume magic-link tokens
- templates/auth/magic_link_request.html, templates/auth/oauth_finish_signup.html
- tests/test_oauth_magic_link.py + tests/_run_oauth_magic_link_windows.py (16 tests)
- config/env.oauth.example

Files modified:
- src/api/auth.py — 5 new routes (oauth_provider_login/callback,
  oauth_finish_signup, magic_link_request/consume); login flashes translated FR;
  oauth_*_enabled flags passed to login template
- src/app.py — wires init_oauth_providers(app) after blueprint registration
- src/services/email.py — adds send_magic_link_email() (FR + DictIA brand)
- templates/login.html — refondu IN PLACE (was 178 lines legacy Vue/TW3)
  to extend marketing/base.html with OAuth buttons, password form,
  magic-link CTA, signup link
- templates/auth/check_email.html — adds action='magic_link' branch
- static/css/tailwind.config.js — adds templates/login.html to content
- static/css/marketing.css — rebuilt

Tests: 16/16 PASS via Windows manual driver.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

config/env.oauth.example

@@ -0,0 +1,69 @@
+###############################################################################
+# OAuth Providers — Microsoft 365 + Google (B-2.4)
+###############################################################################
+#
+# These providers complement (do NOT replace) the generic OIDC SSO at
+# config/env.sso.example. Both can be enabled simultaneously: users see
+# Microsoft 365, Google, and SSO buttons on /login, plus the magic-link
+# fallback that does not require any OAuth provider.
+#
+# IMPORTANT — Loi 25 art. 14 (consent must be granular, free, informed):
+# OAuth signups still require Loi 25 consent capture via
+# /auth/oauth/finish-signup BEFORE the User row is created. Existing
+# users (matched by sso_subject or email) skip the consent page and log
+# in directly.
+#
+# Magic-link login (/auth/magic-link, /auth/magic-link/<token>) reuses
+# the SMTP settings from env.email.example — no additional env vars needed.
+
+###############################################################################
+# Microsoft 365 (Microsoft Entra ID, formerly Azure AD)
+###############################################################################
+# 1. Register a new app at https://entra.microsoft.com
+#    > Identity > Applications > App registrations > New registration
+# 2. Set the redirect URI to:
+#       https://your-domain.example/auth/oauth/microsoft/callback
+# 3. Generate a client secret under Certificates & secrets > Client secrets
+# 4. Set MS_CLIENT_ID to the Application (client) ID
+# 5. Set MS_CLIENT_SECRET to the secret VALUE (NOT the secret ID)
+#
+# Tenant restriction: by default the OAuth flow accepts users from any
+# Microsoft tenant (server_metadata_url uses /common/). To restrict to a
+# specific organization, edit src/auth/oauth_providers.py and replace
+# /common/ with your tenant ID (e.g. /your-tenant-id-guid/).
+#
+# MS_CLIENT_ID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
+# MS_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
+
+###############################################################################
+# Google (Google Cloud Console)
+###############################################################################
+# 1. Create an OAuth client at https://console.cloud.google.com
+#    > APIs & Services > Credentials > Create Credentials > OAuth client ID
+#    Application type: "Web application"
+# 2. Set the redirect URI to:
+#       https://your-domain.example/auth/oauth/google/callback
+# 3. Configure the OAuth consent screen in the same console
+#    (must be in "Production" status to accept users outside the test list)
+# 4. Set GOOGLE_CLIENT_ID and GOOGLE_CLIENT_SECRET from the credentials page
+#
+# GOOGLE_CLIENT_ID=xxxxxxxxxxxx-xxxxxxxxxxxx.apps.googleusercontent.com
+# GOOGLE_CLIENT_SECRET=GOCSPX-xxxxxxxxxxxxxxxxxxxx
+
+###############################################################################
+# Notes
+###############################################################################
+#
+# Token storage:
+# - sso_provider stores the literal string "microsoft" or "google"
+# - sso_subject stores the OAuth `sub` claim (provider-issued user ID)
+# - email_verified is set to True automatically (the provider has
+#   already verified the email address)
+# - password is NULL for OAuth-only accounts; users can set a password
+#   later via /forgot-password if they want a fallback login method
+#
+# Magic-link tokens:
+# - Stateless via itsdangerous.URLSafeTimedSerializer
+# - 15-minute expiry, signed with SECRET_KEY + salt 'magic-link-login'
+# - No DB column — tokens are not single-use within the 15-min window
+# - SMTP must be configured (see env.email.example) for the link to send