fix(auth): link verified sign-in methods

[iscekic]

Summary

What

• Link a new sign-in method when the credential proves email ownership.
• Derive web OAuth proof from the raw email_verified claim.
• Pass verified native Apple and Google tokens through the same auto-link path.
• Add settlement, callback, helper, and native route coverage.

Why

Users with the same owned email received DIFFERENT-OAUTH when they used Google and magic link in either order.

How

The shared settlement path now treats autoLinkToExistingUser=true as proof of email ownership after the existing same-provider guard. Web OAuth callers derive that value from email_verified; native Apple and Google token verification already enforces the claim.

Verification

• pnpm run format:changed
• pnpm run typecheck
• pnpm run lint
• pnpm test:db
• cd apps/web && pnpm test -- src/lib/user/index.test.ts src/lib/user/server.test.ts src/lib/user/server-signin-callback.test.ts src/lib/user/sso.test.ts src/app/api/auth/native/token/route.test.ts
• 250 targeted tests passed.
• Bot E2E passed: a Google-first account completed a browser magic-link sign-in and retained the same user id with exactly google and email providers.

E2E Notes

• Real Google OAuth and provider-signed native tokens are not bot-drivable locally. Direction two and native parity use Jest coverage.
• Headless Chromium could not complete the real Cloudflare Turnstile challenge. The verifier used a temporary development-only bypass in the two Turnstile files, saved patches outside the repository, and restored both files byte-for-byte before the baseline check. No bypass remains in the branch.
• The E2E stack used temporary tmux environment values for the live port and host because the local env points to a stale LAN origin. The values were removed during teardown.

Visual Changes

N/A

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Reviewed the auth account-linking fix across settlement logic, web OAuth sign-in callback, and native Apple/Google token routes with high confidence: every autoLinkToExistingUser=true path is backed by genuine email-ownership proof (email_verified is enforced in verifyNativeAppleIdToken, verifyNativeGoogleIdToken, and exchangeNativeGoogleAuthCode; consumed magic-link/code tokens; dev-only fake-login), the same-provider refusal guard is retained, and providers without the claim (GitHub/GitLab/Discord) correctly keep the DIFFERENT-OAUTH refusal. Tests cover both linking directions, no-proof refusal, same-provider refusal, and the fake-login upgrade regression. No memory-leak potential introduced (pure helper + stateless request handling).

Files Reviewed (7 files)

• apps/web/src/lib/user/index.ts
• apps/web/src/lib/user/server.ts
• apps/web/src/app/api/auth/native/token/route.ts
• apps/web/src/lib/user/index.test.ts
• apps/web/src/lib/user/server.test.ts
• apps/web/src/lib/user/server-signin-callback.test.ts
• apps/web/src/app/api/auth/native/token/route.test.ts

---

_{Reviewed by kimi-k3 · Input: 136.3K · Output: 19.3K · Cached: 565.2K}

_{Review guidance: REVIEW.md from base branch main}