[Feature] OAuth / Google login — milestone before required sign-in rollout

[iiamlewis]

Overview

OAuth / Google login must ship before sign-in is made mandatory. Hard dependency for subscriptions, cosmetics, and affiliate tracking — users cannot be linked to purchases without an account.

Scope

• Google OAuth integration
• Login flow on web and mobile
• Session persistence
• Account creation on first OAuth login

Acceptance criteria

• Player can log in with Google account
• Session persists across browser restarts
• New account created automatically on first Google login
• Existing guest data migration path defined
• Marketing permissions capture baked into sign-up flow
• Discord join prompt shown on sign-up

Dependencies

• Blocks: Subscription tiers, cosmetics purchases, affiliate tracking, stats reset, custom names
• Must ship before: Sign-in made mandatory

Notes

Marketing permissions and Discord join prompt must be implemented at the same time as the sign-up flow — not added later.