feat: enterprise identity provider support — GitHub, Google, Azure AD login

Add external IdP authentication via OAuth (GitHub) and OIDC (Google, Azure AD).
Users can sign in with enterprise credentials; accounts are auto-provisioned
and linked on first login. Configured entirely via environment variables.

- schema/011_external_auth.sql: user_identities table + email column on users
- internal/auth/idp/: provider interface, GitHub OAuth, generic OIDC, store,
  handlers (list providers, login redirect, callback with auto-provisioning)
- internal/auth/user_store.go: GetUserByEmail + SetEmail for IdP linking
- cmd/synapbus/main.go: wire IdP routes + agent provisioner adapter
- web/src/routes/login/+page.svelte: IdP buttons above password form
- Tests: domain restriction, store CRUD, provider listing, user provisioning

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cmd/synapbus/main.go

@@ -30,6 +30,7 @@ import (
 	"github.com/synapbus/synapbus/internal/apikeys"
 	"github.com/synapbus/synapbus/internal/attachments"
 	"github.com/synapbus/synapbus/internal/auth"
+	"github.com/synapbus/synapbus/internal/auth/idp"
 	"github.com/synapbus/synapbus/internal/channels"
 	"github.com/synapbus/synapbus/internal/console"
 	"github.com/synapbus/synapbus/internal/dispatcher"
@@ -305,6 +306,13 @@ func runServe(cmd *cobra.Command, args []string) error {
 	// Wire agent lister into auth handlers for OAuth authorize page
 	authHandlers.SetAgentLister(&agentListerAdapter{agentService: agentService})
 
+	// Initialize external identity providers (GitHub, Google, Azure AD)
+	baseURL := authCfg.IssuerURL
+	if baseURL == "" {
+		baseURL = fmt.Sprintf("http://localhost:%d", port)
+	}
+	idpProviders := idp.LoadConfig(baseURL)
+
 	// Register default MCP OAuth client if it doesn't already exist (T016)
 	ensureDefaultMCPClient(ctx, db.DB, authCfg.BcryptCost)
 
@@ -514,6 +522,23 @@ func runServe(cmd *cobra.Command, args []string) error {
 	r.Post("/auth/register", withHumanAgent(authHandlers.HandleRegister, userStore, agentService, channelService))
 	r.Post("/auth/login", withHumanAgent(authHandlers.HandleLogin, userStore, agentService, channelService))
 
+	// External identity provider endpoints (public)
+	if len(idpProviders) > 0 {
+		idpStore := idp.NewUserIdentityStore(db.DB)
+		idpAgentAdapter := &idpAgentProvisioner{agentService: agentService, channelService: channelService}
+		idpHandlers := idp.NewHandlers(idpProviders, idpStore, userStore, sessionStore, idpAgentAdapter)
+		r.Get("/auth/providers", idpHandlers.HandleListProviders)
+		r.Get("/auth/login/{provider}", idpHandlers.HandleLogin)
+		r.Get("/auth/callback/{provider}", idpHandlers.HandleCallback)
+		slog.Info("external identity providers configured", "count", len(idpProviders))
+	} else {
+		// Return empty list when no providers configured
+		r.Get("/auth/providers", func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			w.Write([]byte(`{"providers":[]}`))
+		})
+	}
+
 	// OAuth metadata (public, per RFC 8414)
 	r.Get("/.well-known/oauth-authorization-server", authHandlers.HandleOAuthMetadata)
 
@@ -770,6 +795,28 @@ func (a *agentListerAdapter) ListAgentsByOwner(ctx context.Context, ownerID int6
 	return result, nil
 }
 
+// idpAgentProvisioner adapts agents.AgentService + channels.Service to idp.AgentProvisioner.
+type idpAgentProvisioner struct {
+	agentService   *agents.AgentService
+	channelService *channels.Service
+}
+
+func (a *idpAgentProvisioner) ProvisionHumanAgent(ctx context.Context, username, displayName string, ownerID int64) error {
+	humanAgent, err := a.agentService.EnsureHumanAgent(ctx, username, displayName, ownerID)
+	if err != nil {
+		return fmt.Errorf("ensure human agent: %w", err)
+	}
+	if humanAgent != nil {
+		if chErr := a.channelService.EnsureMyAgentsChannel(ctx, username, humanAgent.Name); chErr != nil {
+			slog.Warn("failed to ensure my-agents channel after IdP login",
+				"username", username,
+				"error", chErr,
+			)
+		}
+	}
+	return nil
+}
+
 // ensureDefaultMCPClient creates the "mcp-default" public OAuth client if it doesn't exist.
 // This client is used by MCP clients connecting via OAuth 2.1.
 func ensureDefaultMCPClient(ctx context.Context, db *sql.DB, bcryptCost int) {