Journey Auth

It reads your auth plan from 02-plan.md, then delegates to auth-setup to walk you through configuring each provider (Google, GitHub, Apple) by prompting for client IDs and secrets. The nice part is it confirms what you're about to do before touching anything, then hands back the redirect URLs you need to paste into each provider's console. Gets skipped entirely if your plan doesn't need end-user auth. One thing to watch: it won't echo secrets back to you, so have your provider dashboards open when you run it.