[Bccorb]

Adds guidance on which OAuth providers to enable to the OAuth login guide, alongside fells-code/seamless-cli#215.

Change

• Choosing A Provider: an OAuth provider's email decides which local account a sign-in belongs to, so enable providers that verify addresses and say so in the profile. Point emailVerifiedJsonPath only at a claim the provider sets after verifying, never at a field a user or another tenant's administrator controls or at a value that is always true. Use accountLinking: disabled for a provider you do not trust to verify addresses
• Microsoft Entra ID: register a single-tenant application and use the tenant's endpoints, not common, organizations or consumers. Notes that seamless init --oauth now asks for the tenant id
• Linked from the provider field table and from Security Notes

Checks

npm run lint, npm run typecheck (0 errors), npm run build and prettier pass.