fix(config): forward Google email OAuth settings through Compose (#5650)

* fix(config): forward Google OAuth env vars into Docker container and document setup

GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, and GOOGLE_OAUTH_REDIRECT_URI
were read by the app but never forwarded through docker-compose.yml's explicit
environment allowlist, causing the "not set" error even when the vars existed in .env.

Also adds a documented section to .env.example with step-by-step GCP setup instructions
so users know where to get the credentials.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(config): cover OAuth in standalone compose files

* test(config): parse OAuth compose service env

* test(config): keep checkout skip wording neutral

---------

Co-authored-by: TNTBA <trynottobreakanything@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_email_oauth_docker_config.py

@@ -0,0 +1,68 @@
+"""Regression coverage for Google OAuth configuration in Docker Compose."""
+
+from pathlib import Path
+
+import pytest
+import yaml
+
+
+ROOT = Path(__file__).resolve().parent.parent
+COMPOSE_PATHS = tuple(
+    ROOT / name
+    for name in (
+        "docker-compose.yml",
+        "docker-compose.gpu-nvidia.yml",
+        "docker-compose.gpu-amd.yml",
+    )
+)
+ENV_EXAMPLE_PATH = ROOT / ".env.example"
+
+
+def _env_example():
+    if not ENV_EXAMPLE_PATH.exists():
+        pytest.skip("this checkout does not include the optional .env.example file")
+    return ENV_EXAMPLE_PATH.read_text(encoding="utf-8")
+
+
+def _odysseus_environment(path):
+    compose = yaml.safe_load(path.read_text(encoding="utf-8"))
+    return set(compose["services"]["odysseus"]["environment"])
+
+
+@pytest.mark.parametrize(
+    "key",
+    (
+        "GOOGLE_OAUTH_CLIENT_ID",
+        "GOOGLE_OAUTH_CLIENT_SECRET",
+        "GOOGLE_OAUTH_REDIRECT_URI",
+    ),
+)
+def test_google_oauth_setting_is_forwarded(key):
+    expected = f"{key}=${{{key}:-}}"
+    for path in COMPOSE_PATHS:
+        assert expected in _odysseus_environment(path), path.name
+
+
+@pytest.mark.parametrize(
+    "key",
+    (
+        "GOOGLE_OAUTH_CLIENT_ID",
+        "GOOGLE_OAUTH_CLIENT_SECRET",
+        "GOOGLE_OAUTH_REDIRECT_URI",
+    ),
+)
+def test_google_oauth_setting_is_documented(key):
+    assert f"# {key}=" in _env_example()
+
+
+def test_google_oauth_example_uses_a_neutral_secret_placeholder():
+    env_example = _env_example()
+    assert "GOOGLE_OAUTH_CLIENT_SECRET=replace-with-client-secret" in env_example
+    assert "GOCSPX-" not in env_example
+
+
+def test_redirect_documentation_covers_https_and_reverse_proxies():
+    oauth_section = _env_example().split("# Google OAuth2", 1)[1].split("# Misc", 1)[0]
+    assert "HTTPS" in oauth_section
+    assert "reverse-proxy" in oauth_section
+    assert "exactly match an authorized redirect URI" in oauth_section