Verify client sign-in end to end once the consent screen is published

Until the OAuth consent screen is PUBLISHED (Google Auth Platform -> Audience -> Publish app, project evolutiva-489901), only listed test users can sign in; an unlisted client hits Google's 403 access_denied before ever reaching our allowlist, which looks identical to being unregistered. Elazar said 'publish it' 2026-09-11 but the action is console-only and cannot be taken or observed from this host. Acceptance: Puia (sebastian.puia@odontologia.uba.ar, row seeded) completes a real Google sign-in at https://preguntas-pen.pensanta.com and sees the puia question list. Until that single end-to-end run happens the sign-in path is unexercised - the 302 to accounts.google.com only proves the request is well-formed, not that the callback, session cookie and allowlist lookup work.