[eliasjpr]

Summary

• Adds normalized Authly::SocialProfile, Authly::Social::Provider, and pluggable Authly::Social::HttpClient (with bounded 1 MB response reads and 10s timeouts).
• Implements 6 built-in social identity provider adapters:
  • Google (Authly::Social::Google — OAuth 2.0 + OIDC /v1/userinfo and id_token verification)
  • GitHub (Authly::Social::GitHub — OAuth 2.0 + /user + /user/emails fallback for primary verified email)
  • Apple (Authly::Social::Apple — Sign in with Apple with form_post, id_token verification, and first-login user JSON payload extraction)
  • Microsoft / Entra ID (Authly::Social::Microsoft — configurable tenant + Microsoft Graph OIDC UserInfo)
  • Discord (Authly::Social::Discord — /users/@me + CDN avatar resolution)
  • Generic OAuth2 / OIDC (Authly::Social::GenericOAuth2 — configurable endpoints and claim field mappings)
• Adds browser redirect & callback endpoints (GET /oauth/social/:provider and GET|POST /oauth/social/:provider/callback) with S256 PKCE and single-use signed CSRF state tokens.
• Adds token endpoint social grant exchange (POST /oauth/token with grant_type=social and urn:ietf:params:oauth:grant-type:social).
• Extends AuthorizableOwner#resolve_social_owner(profile) and Authly.config.social_owner_resolver / Authly.config.on_social_authenticated.
• Includes comprehensive specs in spec/social_auth_spec.cr and GitBook documentation in docs/how-to/social-sign-in.md.