[codex] Seed auth provider emulators for app callbacks

[BLamy]

What changed

• Expands auth-provider emulator env vars for Google, Apple, Microsoft Entra ID, Okta/Auth0, and Clerk.
• Exposes common SDK/env aliases such as AUTH_GOOGLE_ID, AUTH_MICROSOFT_ENTRA_ID_ID, AZURE_AD_CLIENT_ID, AUTH0_ISSUER_BASE_URL, CLERK_CLIENT_ID, and shared AUTH_URL / NEXTAUTH_URL values.
• Seeds OAuth/OIDC clients into worker-started auth emulators with redirect URIs based on the actual emulated app URL and port.
• Includes callback aliases used by common app frameworks, including /api/auth/callback/* and /auth/callback/*, plus Microsoft Entra and Auth0 aliases.
• Extends the emulatable runtime check to decode the generated emulator startup script and verify the seeded callback URLs.

Why

Auth emulators already started on fixed ports, but their default OAuth clients used static localhost:3000 callbacks. Apps running under Loop QA use dynamic ports such as 8080 or 18080, so provider authorize pages can reject the app callback unless the worker seeds provider clients for the real emulated app URL.

Validation

• npm install && npm run check

Companion change

GrooveCart PR #3 adds the provider buttons and local auth-emulator Playwright coverage that exercises this support.

[github-actions]

🔎 Loop QA preview (all-k8s backend): https://pr-27--loop-qa-j63k5x.netlify.app

Production (qa.replay.io) is unaffected — still on Fly.