fix(auth): make social login use one redirect navigation

[iamjr15]

Summary

• Replace forced popup OAuth for sign-in and sign-up with Clerk's full-page redirect flow.
• Prevent a remotely chunked popup callback from crashing the signed-out Next.js tree during session replacement.
• Restore strict Cross-Origin-Opener-Policy: same-origin now that authentication does not need an opener relationship.

Root cause

Production Google OAuth reached Clerk and created the session, but the popup callback intermittently failed while loading a remote @clerk/ui chunk. The popup then had to reconcile the newly authenticated identity into the already-rendered anonymous application tree, producing the generic client-side exception page.

Architecture

OAuth now performs one authoritative navigation:

Cheatcode sign-in -> Google -> Clerk callback -> requested Cheatcode path

The installed @clerk/ui version remains pinned through ClerkProvider; only the transport changes.

Decisions made

Decision	Choice	Alternative	Reasoning
OAuth transport	Full-page redirect	Forced popup	Removes popup lifecycle, opener, and cross-window identity reconciliation failure modes.
Opener policy	same-origin	same-origin-allow-popups	Redirect auth no longer requires cross-origin opener access, so production isolation can be strict.
Clerk UI version	Keep pinned	Remove ui={ui}	Version pinning is Clerk's documented deterministic-rendering path.

Verification

• pnpm lint
• pnpm typecheck
• pnpm turbo build --force
• pnpm deadcode
• pnpm architecture:check
• pnpm turbo skills:build
• Reproduced production Google sign-in with the requested Google account and captured the failing Clerk UI chunk before the change.
• Post-deploy acceptance: repeat sign-out -> Google account selection -> Clerk callback -> authenticated Cheatcode route, then inspect console and network errors.

Scope

No database, migration, environment, API, or worker topology changes.