fix(oauth): add cursor affordances to provider buttons

[LudoLoops]

Summary

• Give both OAuth provider buttons a pointer cursor when enabled and a not-allowed cursor during sign-in, using Tailwind utilities and preserving the Skeleton button preset.
• Guard concurrent sign-in attempts and test pending, success, and rejection state transitions.
• Regenerate the OAuth templates/module recipe and include the required changeset and Graphify output.

Part of #594.

Validation

• bun run build:all — passed.
• bun run lint — passed.
• bun run typecheck — passed.
• OAuth button behavior tests — 2 passed.
• Related module/capability/upgrade tests — 54 passed.
• OAuth declaration tests with a 30s timeout — 5 passed (the default 5s limit timed out in a combined run).
• dashboard-integrations scaffold — build and design-system check passed; Vitest could not connect to the intentionally unavailable PostgreSQL test endpoint at 127.0.0.1:1.

[LudoLoops]

Review completed — no merge blockers (head a6b55d9354c9138ab07703b7b211aa94b96e8441).

This focused OAuth tranche of #594 adds Tailwind-only pointer/not-allowed cursor states to the existing Google/GitHub Skeleton-styled buttons. While either OAuth sign-in is pending, both controls remain natively disabled; the additional synchronous if (loading !== null) return guard prevents a second provider invocation before the first promise settles. Existing provider payloads, callback URL, spinner/labels, preset classes, error logging, and finally state reset are preserved.

• New tests/oauth-buttons.test.ts verifies initial enabled cursor classes, both buttons' disabled/not-allowed state during a pending promise, prevention of a competing click, loading spinner, restored state on resolution, and recovery on rejection.
• Canonical OAuth component, generated packages/oauth/src/templates.ts, and packages/svforge/src/module-recipes.ts contain the same code. The Changeset covers both @svforge/oauth and svforge; Graphify is updated. No custom CSS or unnecessary shared dependency was introduced.
• Reported Dashboard integration-scaffold Vitest error was against an explicitly unavailable PostgreSQL endpoint (127.0.0.1:1). Its generated project build and design-system check succeeded; the database connectivity issue does not establish a regression in the OAuth UI.
• GitHub Actions CI fix(compat): replace deprecated Kit 3 lib alias #597 PASSED on this exact head: required quality job succeeded, including lint, typecheck, dependency/Better Auth audits, generated-manifest freshness, build-all, and the full root test suite. main-smoke is correctly skipped for a PR. No outstanding review threads. GitHub reports the PR clean and mergeable.
• Leave issue refactor(ui): audit all scaffolded components for a minimal Skeleton v5-first baseline #594 open for the remaining component families; no npm publishing requested.

MERGE DECISION: READY TO MERGE.