Social OAuth environment variables

Required for canonical URL / callbacks ``` NEXTAUTH_URL=https://app.goals.ac AUTH_SECRET=random-32-char-string ```

LinkedIn ``` LINKEDIN_CLIENT_ID= LINKEDIN_CLIENT_SECRET= ```

X (Twitter) ``` TWITTER_CLIENT_ID= TWITTER_CLIENT_SECRET= ```

Meta (Facebook + Instagram) ``` META_APP_ID= META_APP_SECRET= ```

Bluesky ``` BLUESKY_CLIENT_NAME=goals.ac BLUESKY_OAUTH_PRIVATE_KEY_JWK= ```

Mastodon No platform-level env vars, per-instance OAuth is registered at connect time.

Encryption CMS and social tokens are encrypted with: ``` SECRETS_ENCRYPTION_KEY= ``` Changing this secret invalidates all stored credentials.

See individual platform admin guides for redirect URI paths and portal setup details.