Verify Google OAuth profile setup captures WhatsApp and timezone

[Taleef7]

Context

docs/plan-CorvEd.md calls out Google OAuth profile setup as an open verification question. OAuth users still need WhatsApp number and timezone captured before using the app fully.

Acceptance criteria

• Verify the OAuth callback sends incomplete profiles to /auth/profile-setup.
• Verify profile setup captures display name, WhatsApp number, timezone, and role context as intended.
• Add or update E2E/unit coverage if practical.
• Document any remaining Supabase OAuth configuration needed for production.

References

• docs/plan-CorvEd.md open question Epic E1: repository and engineering foundation (P0) #5
• Related closed issue: S3.1 as a user, I can sign up/login with email/password or Google #18