sso signup & login

.env.example

@@ -160,6 +160,46 @@ AWS_SECRET_ACCESS_KEY=minioadmin
 # ALLOW_HTTP_PROXY=1
 # Custom frontend directory (defaults to ./frontend/dist)
 # FRONTEND_DIR=/path/to/frontend/dist
+# =============================================================================
+# SSO / Social Login
+# =============================================================================
+# Each provider requires ENABLED=true plus CLIENT_ID and CLIENT_SECRET.
+# Register your PDS as an OAuth application with each provider to get credentials.
+
+# GitHub
+# SSO_GITHUB_ENABLED=true
+# SSO_GITHUB_CLIENT_ID=
+# SSO_GITHUB_CLIENT_SECRET=
+
+# Discord
+# SSO_DISCORD_ENABLED=true
+# SSO_DISCORD_CLIENT_ID=
+# SSO_DISCORD_CLIENT_SECRET=
+
+# Google
+# SSO_GOOGLE_ENABLED=true
+# SSO_GOOGLE_CLIENT_ID=
+# SSO_GOOGLE_CLIENT_SECRET=
+
+# GitLab (set ISSUER for self-hosted instances)
+# SSO_GITLAB_ENABLED=false
+# SSO_GITLAB_CLIENT_ID=
+# SSO_GITLAB_CLIENT_SECRET=
+# SSO_GITLAB_ISSUER=https://gitlab.com
+
+# Generic OIDC
+# SSO_OIDC_ENABLED=false
+# SSO_OIDC_CLIENT_ID=
+# SSO_OIDC_CLIENT_SECRET=
+# SSO_OIDC_ISSUER=https://your-identity-provider.com
+# SSO_OIDC_NAME=Custom Provider
+
+# Apple Sign-in
+# SSO_APPLE_ENABLED=true
+# SSO_APPLE_CLIENT_ID=com.example.signin    # Services ID from Apple Developer Portal
+# SSO_APPLE_TEAM_ID=XXXXXXXXXX              # 10-character Team ID
+# SSO_APPLE_KEY_ID=XXXXXXXXXX               # Key ID from portal
+# SSO_APPLE_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
 CARGO_MOMMYS_LITTLE=mister
 CARGO_MOMMYS_PRONOUNS=his
 CARGO_MOMMYS_ROLES=daddy