WebView 应用中的 Google 登录和 Sign in with Apple：Firebase Auth 的 Codex 工作流程

## Authentication (Firebase Auth inside WebViewGold)
- Providers: email/password, Google, Apple. Google and Apple buttons live in one
  component (src/components/SocialButtons.tsx) with equal size and prominence.
- Every sign-in call goes through src/lib/auth.ts. Inside the native app
  (isNativeApp()) use signInWithRedirect, which Firebase recommends on mobile;
  keep the method in one constant so we can switch to popup after device tests.
  Desktop browsers may use signInWithPopup.
- authDomain is our own domain (app.example.com). Express proxies /__/auth/* to
  PROJECT_ID.firebaseapp.com as a transparent reverse proxy. Never point
  authDomain back to firebaseapp.com.
- Google inside the app works through WebViewGold's Social Login Helper
  (google_login_helper_triggers / GOOGLE_LOGIN_HELPER_TRIGGERS). Do not change the
  user agent, do not open OAuth URLs with window.open, do not use googlelogin://
  unless explicitly asked.
- Sign in with Apple (appleid.apple.com) is handled by WebViewGold on iOS.
- Apple shares the name only on the first sign-in: write displayName to users/{uid}
  immediately. Expect @privaterelay.appleid.com addresses.
- auth/account-exists-with-different-credential: ask the user to sign in with the
  existing method, then linkWithCredential. Never create a second account silently.

// Config.swift: Social Login Helper triggers (documented defaults)
var google_login_helper_triggers: [String] = ["https://accounts.google.com", "https://accounts.youtube.com"]
var facebook_login_helper_triggers: [String] = ["https://m.facebook.com", "https://www.facebook.com"]

// Sign in with Apple (appleid.apple.com) needs no trigger: WebViewGold handles it on iOS.

// Keep sessions across launches: leave deletecache and deletecacheonexit off,
// or users are logged out every time they open the app.
// Custom user agent (useragent_iphone / useragent_ipad): append your marker to the
// default string instead of replacing it.