feat(#413): implement GET /auth/config discovery endpoint

- Add getAuthConfig() to AuthService (email always, OIDC when enabled)
- Add GET /auth/config public endpoint with Cache-Control: 5min
- Place endpoint before catch-all to avoid interception

Refs #413

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/auth/auth.controller.ts

@@ -4,6 +4,7 @@ import {
   Req,
   Res,
   Get,
+  Header,
   UseGuards,
   Request,
   Logger,
@@ -12,7 +13,7 @@ import {
 } from "@nestjs/common";
 import { Throttle } from "@nestjs/throttler";
 import type { Request as ExpressRequest, Response as ExpressResponse } from "express";
-import type { AuthUser, AuthSession } from "@mosaic/shared";
+import type { AuthUser, AuthSession, AuthConfigResponse } from "@mosaic/shared";
 import { AuthService } from "./auth.service";
 import { AuthGuard } from "./guards/auth.guard";
 import { CurrentUser } from "./decorators/current-user.decorator";
@@ -89,6 +90,17 @@ export class AuthController {
     return profile;
   }
 
+  /**
+   * Get available authentication providers.
+   * Public endpoint (no auth guard) so the frontend can discover login options
+   * before the user is authenticated.
+   */
+  @Get("config")
+  @Header("Cache-Control", "public, max-age=300")
+  getConfig(): AuthConfigResponse {
+    return this.authService.getAuthConfig();
+  }
+
   /**
    * Handle all other auth routes (sign-in, sign-up, sign-out, etc.)
    * Delegates to BetterAuth