feat(auth): sync OAuth provider tokens to backend via NextAuth session

Wire the Google/Facebook OAuth callback flow end-to-end so the provider's id_token (Google) and access_token (Facebook) captured by NextAuth are forwarded to the backend in exchange for business tokens:

- Extend the NextAuth config with jwt/session callbacks that surface `account.id_token` / `account.access_token` to the client during first sign-in
- Add an `OAuthSessionSync` bridge mounted inside `RootProviders` that listens to `useSession()` and dispatches new `AuthGoogleSyncSubmitted` / `AuthFacebookSyncSubmitted` events
- Add corresponding actors in the auth XState machine that call `authRepository.googleLogin` / `facebookLogin`, persisting the backend's `LoginResponse` through the existing repository path

This keeps all authentication orchestrated by the auth state machine while preserving NextAuth's OAuth redirect UX.

src/types/next-auth.d.ts

@@ -0,0 +1,25 @@
+import "next-auth";
+
+/**
+ * 扩展 next-auth v4 的 Session 类型
+ *
+ * `src/lib/auth/nextauth.ts` 的 jwt/session callbacks 把
+ *   - OAuth provider 名（"google" | "facebook"）
+ *   - Google id_token
+ *   - Facebook access_token
+ * 塞进了 session 对象。
+ *
+ * 这里通过 TS 声明合并暴露给 `useSession()` 消费者。
+ *
+ * 注：声明文件全局生效（`globals.d.ts` 风格）—— 不用手动 import。
+ */
+declare module "next-auth" {
+  interface Session {
+    /** OAuth provider 名（首次 sign-in 时由 jwt callback 注入） */
+    provider?: "google" | "facebook";
+    /** Google OAuth id_token —— 调后端 /api/auth/google-login 换业务 token */
+    idToken?: string;
+    /** Facebook OAuth access_token —— 调后端 /api/auth/facebook-login 换业务 token */
+    accessToken?: string;
+  }
+}