feat(auth): advertise configured login providers on the public env endpoint

[Farahat612]

Nothing told the dashboard which OAuth providers this instance actually
has credentials for, so it guessed from selfHosted: cloud got hardcoded
github+google buttons, self-hosted got none: hiding working buttons
from every operator who had configured a provider, and set to render
dead buttons on any cloud deploy missing a pair. TODO.md names a
server-advertised provider list as the first task for both the SSO item
and the git-provider plan (#75).

The predicate "is this provider configured?" now lives once in
lib/auth-providers.ts: lib/auth.ts reads the credential pairs to
register providers with Better Auth, and GET /health/env advertises the
resulting list as authProviders: ids and a kind discriminator only,
never credentials (asserted in tests; the route is unauthenticated).
Both halves of a pair are required; half-configured counts as absent.
kind is "social" for everything today: the field exists so a future
SSO entry can be advertised without an older dashboard drawing it as a
branded button. Git-provider capabilities are deliberately a separate
future field: a git remote is not a login button.

OAuthButtons renders the intersection of what the server advertises and
what the build can draw (icon + translated label), in a stable order,
and renders nothing: no divider: for an empty list, which makes the
!selfHosted gates on login and register removable. authMode "none"
instances are untouched (the desktop redirect precedes the form). No
new i18n keys: labels stay t.auth.oauth[id], now indexed by id.

Tests: provider predicate (configured/absent/half-configured/no secret
leakage), the endpoint seam both ways, the pure list-to-buttons mapping,
and server-rendered button output for advertised, empty and unknown-kind
lists.

Part of the SSO groundwork: this is the named first task of the SSO item in
TODO.md ("a server-advertised provider list ... is the real first task"). The
same missing primitive is referenced in the git-providers section, but this
change is only about login providers and does not touch git in any way.

Behavioral improvement: a self-hosted instance with OAuth credentials
configured now shows working login buttons (previously hidden outright by the
selfHosted guess). Default self-hosted (no creds) and cloud are unchanged.
The unauthenticated payload carries provider ids and a kind discriminator
only, never credentials (asserted in tests). No new i18n keys; labels are
indexed by provider id.

How verified: tests on the provider predicate (configured, absent,
half-configured, no secret leakage), the endpoint seam both ways, the pure
list-to-buttons mapping, and server-rendered button output for advertised,
empty and unknown-kind lists. apps/api and dashboard suites green,
typechecks clean.