feat(auth): replace email OTP with Google Sign-In (Supabase Auth)

[aguilar1x]

Context

Authentication/verification currently uses an email OTP flow sent via Resend from Next.js serverless routes:

• apps/web/app/api/waitlist/submit/route.ts
• apps/web/app/api/waitlist/request-otp/route.ts
• apps/web/app/api/waitlist/verify/route.ts
• OTP fields on waitlist_submissions (otp, otp_expires_at)

We are replacing this with Google Sign-In via Supabase Auth (Google provider). This is frontend + Supabase configuration — not part of the NestJS backend rollout (#135–#139).

Scope

• Enable the Google provider in Supabase Auth (OAuth client, redirect URLs, env config).
• Add a Sign in with Google flow in apps/web (sign-in UI + session handling via Supabase Auth).
• Migrate the waitlist / early-access verification to use the Google identity instead of email OTP.
• Remove the OTP flow: delete the request-otp / verify routes (and OTP usage in submit), remove the Resend OTP calls, and drop the otp / otp_expires_at columns (migration).
• Keep the access code flow (access_codes) as-is unless it overlaps.

Acceptance criteria

• Users can sign in with Google via Supabase Auth.
• The email OTP routes and OTP columns are removed; no Resend OTP code remains.
• Early-access / waitlist verification works through the new Google flow.
• npm run type-check / biome:check / build pass with no dangling references to the removed OTP code.

Relationship to other work

• Independent of the backend rollout (feat(backend): scaffold NestJS app in apps/backend (phase 1 — setup) #135–feat(backend): notification service / event-driven emails (phase 5) #139). The backend's notification service (feat(backend): notification service / event-driven emails (phase 5) #139) still handles transactional/event emails (e.g. dispute opened) — those are not auth OTP.
• Removing OTP is why the expired-OTP cleanup job was dropped from feat(backend): scheduled cleanup & SLA jobs / cron (phase 3) #137.