Add Google SSO

- Migration: profiles.username is now nullable -- Google's OAuth
  redirect can't collect a username up front the way the email/password
  signup form does, so a first-time Google sign-in's profile is created
  with no username.
- supabase/config.toml: [auth.external.google] enabled, credentials via
  env() substitution (SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID/_SECRET
  in .env.local, which the CLI auto-loads). skip_nonce_check is on,
  which Supabase's own docs call out as required for local sign-in.
- LoginScreen: "Continue with Google" alongside the existing
  email/password form.
- CompleteProfileScreen: one-time gate for a signed-in user with no
  username yet (i.e. first Google sign-in) -- same hard-gate spirit as
  email verification, nothing else is usable until a username is set.
- App.tsx now checks profiles.username after establishing a session and
  routes to CompleteProfileScreen before AppShell when it's missing.

RLS test suite re-run clean (23/23) after the schema change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017DUU6CnxECCDeqDNYJgr5x

supabase/migrations/20260907040804_allow_null_username_for_oauth.sql

@@ -0,0 +1,8 @@
+-- Google SSO can't collect a username before the OAuth redirect happens
+-- (unlike email/password signup, where we pass it as signup metadata) --
+-- so a first-time Google sign-in's profile row is created with no username,
+-- and the app prompts for one right after (a "complete your profile" gate,
+-- the same hard-gate spirit as email verification). The uniqueness
+-- constraint still holds; Postgres treats multiple NULLs as distinct, so
+-- several pending Google sign-ins can coexist before choosing a username.
+alter table public.profiles alter column username drop not null;