fix(config): forward Google email OAuth settings through Compose

[RaresKeY]

Summary

Forward the three Google email OAuth settings through every shipped Docker Compose entry point: the base file plus the standalone NVIDIA and AMD files. Without this allowlist, values present in the host .env never reach the app container and the OAuth setup reports that its client configuration is absent.

This successor preserves TNTBA's focused commit from #5020, replaces the secret-shaped documentation placeholder, clarifies explicit redirect URLs for HTTPS/reverse-proxy deployments, and adds parity regression coverage.

Supersedes #5020 while preserving its original authored commit.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #5640

Part of #5637

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)
• New feature (non-breaking — adds new behaviour)
• Breaking change (changes or removes existing behaviour)
• Refactor / cleanup (behaviour unchanged)
• Documentation only
• CI / tooling / configuration

Checklist

• I searched open issues and open PRs — fix(config): forward Google OAuth env vars into Docker container and document setup #5020 is the focused predecessor whose authored commit is preserved here.
• This PR targets dev.
• My changes are limited to Google OAuth Compose forwarding, matching setup guidance, and focused parity tests.
• I ran the app end-to-end. The isolated test environment does not provide Docker, so container startup remains a maintainer validation item.

How to Test

1. Run:

   python -m pytest -q tests/test_email_oauth_docker_config.py tests/test_gpu_compose_standalone.py tests/test_docker_devops_hardening.py

2. Set GOOGLE_OAUTH_CLIENT_ID, GOOGLE_OAUTH_CLIENT_SECRET, and GOOGLE_OAUTH_REDIRECT_URI in the host environment.

3. Start each applicable Compose entry point and run a presence-only check that does not print any value:

   docker compose exec odysseus sh -eu -c '
     for name in GOOGLE_OAUTH_CLIENT_ID GOOGLE_OAUTH_CLIENT_SECRET GOOGLE_OAUTH_REDIRECT_URI; do
       test -n "$(printenv "$name")"
     done
   '

4. Verify the command succeeds for the base, NVIDIA, and AMD standalone files.

Current isolated validation passes 53 focused/adjacent tests with 5 expected .env* documentation skips. Parsed-YAML mutation checks reject comment-only and wrong-service forwarding. The Docker CLI is unavailable in that runner.

Visual / UI changes — REQUIRED if you touched anything that renders

No visual or frontend files changed.

• Screenshot or short clip — not applicable; no rendering changed.
• Style match — no UI change.
• No new component patterns.
• I am not an LLM agent submitting a bulk PR. Contributor attestation remains for the human author.