feat(auth): Google OAuth, sealed session and default-deny gating (T9)

Gate the app behind Google sign-in restricted to verified @theodo.com
identities, and record the real reporter on filed defects (F9).

- nuxt-auth-utils for sealed cookie sessions + the Google OAuth handler,
  mounted at /auth/google/callback to match the registered redirect URI.
- isAllowedGoogleUser re-derives the domain from Google's verified email;
  the spoofable `hd` claim is deliberately ignored (DESIGN T9).
- Default-deny: server middleware 401s unauthenticated /api calls (health
  and the session endpoint excepted); a global route middleware redirects
  unauthenticated page navigations to /login.
- getReporter() now reads the session email instead of the dev stub.
- Env contract moves to nuxt-auth-utils names (NUXT_SESSION_PASSWORD,
  NUXT_OAUTH_GOOGLE_*); .env.example, compose and README updated.

Unit-tested: domain check (incl. hd-spoof + look-alike) and public-path
matching. Live OAuth round-trip pending manual verification.

README.md

@@ -61,8 +61,10 @@ migrate step is needed.
 1. Point Coolify at this repo; it builds the production `Dockerfile`.
 2. Create a **managed Postgres** in Coolify (automatic backups — [ADR 0003](./docs/adr/0003-use-coolify-managed-postgres-over-sqlite.md))
    and set `DATABASE_URL` to it. _(Alternatively deploy `docker-compose.yml`, which bundles a Postgres service.)_
-3. Set the env vars from [`.env.example`](./.env.example) (`NUXT_SESSION_SECRET`,
-   Google OAuth, VAPID) and route `andon.apoena.dev` to the service.
+3. Set the env vars from [`.env.example`](./.env.example) (`NUXT_SESSION_PASSWORD`,
+   `NUXT_OAUTH_GOOGLE_*`, VAPID) and route `andon.apoena.dev` to the service. Add
+   `https://andon.apoena.dev/auth/google/callback` as an Authorized redirect URI
+   in the Google Cloud OAuth client.
 4. **Enable Coolify's autodeploy** so it builds and deploys on every push to
    `main`. Protect `main` with required PR review + CI so only vetted commits
    reach production.