Social verification: mark GitHub/X links verified only via OAuth

[jal-co]

Profile social links (GitHub, X, website) must not imply verified identity unless we can prove it. Show a link as verified only when the account is connected via that provider's OAuth; otherwise render it as self-asserted / unverified. Consistent with Modulora's provenance-first stance (never claim what we can't prove).

Behavior

• GitHub: already connectable via OAuth (Auth: secure alpha invitation setup and provider linking #12, Account settings: /settings (profile, socials, danger zone) #16). When connected, the GitHub link is derived from the OAuth account and marked verified. A hand-typed GitHub URL that doesn't match the connected account is shown unverified.
• X: add "Login/Connect with X" (OAuth). Until connected, an X link is unverified. (Better Auth social provider once X app credentials exist.)
• Website: unverified unless the domain is proven (ties into DNS-TXT domain verification, Domain verification via DNS TXT record #35/Domain verification via DNS TXT record #37).

Data + UI

• Track which socials are OAuth-verified (e.g. from the account provider rows / a verified flag per link).
• Public profile + component byline: verified links get a small scoped indicator ("verified via GitHub"), unverified links render plainly with no claim (optionally a muted "unverified" affordance).
• No generic "verified user" badge — scope each claim to what OAuth actually proves (account ownership, not code safety).

Depends on / relates to

• Auth: secure alpha invitation setup and provider linking #12 GitHub OAuth, Account settings: /settings (profile, socials, danger zone) #16 settings socials, Domain verification via DNS TXT record #35/Domain verification via DNS TXT record #37 domain verification.

Area: Platform

[jal-co]

Shipped: GitHub verified via OAuth (account hook resolves the login, stored as github_username; migration 0008). Profile shows the verified handle with a scoped 'verified via GitHub sign-in' indicator; X + website render plainly (self-asserted). Settings shows 'Verified @'. Follow-ups: X OAuth (needs an X app), website via domain verification (#37).

[jal-co]

Audit update: GitHub/X OAuth identity capture and scoped profile indicators are shipped. Keep open for component-byline scope, typed-link mismatch behavior, unlink/stale identity handling, and provider-failure tests.