[baba-dev]

Why

The Android TWA login showed the Create an account path only after the entire email/password form; new users often never see it. Existing Google OAuth was explicitly configured with disableSignUp: true, making first-time Google onboarding impossible.

Changes

• Put Continue with Google (linked accounts) and Create a free account first, above the email fields, including on 320–430px phones; preserve next=/app.
• Enable explicit Google signups (disableImplicitSignUp: true): registration page requires checked Terms/Privacy consent, sends requestSignUp: true, and receives server-stamped consent through Better Auth's server-only OAuth state.
• Require valid, fresh signed OAuth consent state before a Google identity can create a user; map legal version and trusted receipt timestamp into the user record.
• Retain TOTP-based block for Google on MFA-protected accounts and no implicit linking of existing email/password identities.
• Clarify errors for unlinked accounts, Google signup and failed callbacks.
• Cover first-screen signup discovery, 320/360/393/430 phone widths and legal-consent validation; document Android/Chrome OAuth acceptance gates.

Deployment

Web-only changes, no DB migration and no Android binary changes. Production Google OAuth must be tested in Chrome TWA on a real Android device with a fresh Google identity and an existing linked Google identity. Verify configured Authorized redirect URI https://food.bababuilds.com/api/auth/callback/google. Browser automation cannot complete live Google consent with CI fixtures.

Safety

No implicit Google account linking, no TOTP bypass, no ID-token login, no external OAuth tokens in Android Java or log output.

Checklist

• Typecheck, lint, format, unit and E2E CI green
• Fresh Google signup + consent on installed Android TWA
• Previously linked account Google login
• Same-email password-only account remains unlinked
• MFA Google denial
• First outlet onboarding and relaunch