docs(fork): add service-config checklist + auth verification section

[TortoiseWolfe]

Summary

Yesterday's #85 OAuth incident exposed a fork-onboarding gap: a brand-new forker had to hop between README, FORKING.md, AUTH-SETUP.md, PAYMENT-DEPLOYMENT.md, .env.example, and individual feature docs to figure out which services to set up. No single master checklist existed.

This PR adds three coordinated doc changes that close that gap.

Deliverables

1. docs/FORK-CHECKLIST.md (NEW, ~160 lines)

Single-page master walkthrough with three sections:

• Setup order: numbered 1-9 (rebrand → Supabase → migration → auth → env → payments → email → analytics → verification)
• Service matrix: every external service the template integrates with, in one table (16 rows covering Supabase, GitHub/Google OAuth, Stripe, PayPal, Web3Forms, EmailJS, Resend, GA4, PageSpeed, Calendar, Disqus, Cash App, Chime, author metadata, Docker config)
• Common pitfalls: led with the OAuth providers misconfigured: Google + GitHub Client IDs are literal 'placeholder_*' strings #85 placeholder-OAuth-Client-ID footgun, plus production site_url / uri_allow_list, .env security, Supabase Vault for server secrets, Docker-first install rule

2. docs/AUTH-SETUP.md polish (+50 lines)

• Cross-link callout at the top pointing first-time forkers to FORK-CHECKLIST.md so they don't land on this deep-dive doc cold
• New "Verification via Management API" section with a copy-pasteable curl + jq command that prints current OAuth Client IDs in one line. This is the exact check that would have caught issue OAuth providers misconfigured: Google + GitHub Client IDs are literal 'placeholder_*' strings #85 weeks earlier. Includes red-flag patterns (literal placeholder_* strings, IDs that don't end in .apps.googleusercontent.com for Google, etc.).

3. README.md updates (+21 lines)

• Quick Start callout (blockquote) pointing to FORK-CHECKLIST.md as the first thing a forker should read
• New "🔐 Authentication Setup" section between Payment Integration and GitHub Actions Secrets, with a 5-step hyperlinked path through AUTH-SETUP.md and explicit mention of the Management API verification step

Verification

• ✅ All 12 in-repo target files exist (spot-checked)
• ✅ All FORKING.md heading anchors corrected (GitHub auto-slug includes parenthetical suffixes, e.g. quick-start-5-minutes, syncing-with-upstream-scripthammer)
• ✅ README mentions FORK-CHECKLIST 2x, AUTH-SETUP 6x — discoverable
• ✅ 27 distinct hyperlinks in FORK-CHECKLIST.md, all resolve to either real files or live URLs
• ✅ Pre-push hooks (lint, type-check, build) all green

What this PR does NOT do

• Does NOT add Discord / Microsoft / Okta OAuth sections — out of scope (Supabase supports them; the pattern from GitHub/Google translates)
• Does NOT write new setup docs for Resend / Disqus / Sentry / Cash App / Chime — these are either trivial ("paste handle into .env") or stub services
• Does NOT change .env.example — the vars were fine; the missing piece was discoverability
• Does NOT close issue OAuth providers misconfigured: Google + GitHub Client IDs are literal 'placeholder_*' strings #85 — the OAuth dashboard repair still needs user-side work. This PR makes the same class of bug easier to catch next time.

🤖 Generated with Claude Code