Phase 4 Stage 1: backend foundation (additive endpoints + schema)

Schema (idempotent migration):
- payment_sessions.is_free_trial -> is_first_session_discount (data copied)
- payment_sessions.mode TEXT NOT NULL DEFAULT 'chat' CHECK (chat|call)
- chat_sessions.topics TEXT[] for ESP picks (info-only)

New endpoints:
- GET /api/client/onboarding-state (drives verif sheet + S6 paywall gate)
- GET /api/client/chat-pricing (rewrite: chat+call groups + first-session
  discount block, per-customer eligibility)
- GET /api/shared/auth-providers (env-probed; replaces ENABLE_SOCIAL_AUTH
  build flag — frontend cutover lands in stage 2)
- GET /api/client/support-handles (Tanya Admin handles, CC-config-driven)

session_warning WS event fires once at 180s remaining.

app_config seeds (mock pricing tiers, first-session discount, support
handles, payment method order, end-session 2-step toggle).

CC SettingsPage: 3 new sections (first-session discount, pricing tiers
JSON editors, support handles).

15/15 Vitest passing. chat_sessions.is_free_trial also renamed for
consistency (plan only specified payment_sessions; pairing.service.js
read both).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/test/routes/shared.auth-providers.routes.test.js

@@ -0,0 +1,87 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest'
+
+// Same pattern as the other route tests — keep the websocket plugin no-op so
+// buildPublic doesn't try to open real WS upgrades.
+vi.mock('../../src/plugins/websocket.js', () => ({
+  sendToUser: vi.fn(() => false),
+  sendToSessionParticipant: vi.fn(() => false),
+  registerWebSocketPlugin: vi.fn(async () => {}),
+  registerWebSocketRoute: vi.fn(),
+  isUserOnlineWs: vi.fn(() => false),
+  getSessionConnections: vi.fn(() => ({})),
+}))
+
+vi.mock('../../src/services/notification.service.js', () => ({
+  sendPushNotification: vi.fn(async () => true),
+  registerDeviceToken: vi.fn(async () => {}),
+}))
+
+describe('GET /api/shared/auth-providers (Phase 4)', () => {
+  // Snapshot env so we can mutate freely and restore.
+  const ENV_KEYS = [
+    'GOOGLE_OAUTH_CLIENT_ID',
+    'GOOGLE_OAUTH_CLIENT_SECRET',
+    'APPLE_OAUTH_CLIENT_ID',
+    'APPLE_OAUTH_TEAM_ID',
+    'APPLE_OAUTH_KEY_ID',
+    'APPLE_OAUTH_PRIVATE_KEY',
+  ]
+  let original
+
+  beforeEach(() => {
+    original = Object.fromEntries(ENV_KEYS.map((k) => [k, process.env[k]]))
+    for (const k of ENV_KEYS) delete process.env[k]
+  })
+
+  afterEach(() => {
+    for (const k of ENV_KEYS) {
+      if (original[k] === undefined) delete process.env[k]
+      else process.env[k] = original[k]
+    }
+  })
+
+  it('returns enabled:false for google + apple when env vars are unset; phone always true', async () => {
+    // Re-import service to drop the module-load cache, then reset its in-memory cache.
+    const svc = await import('../../src/services/auth-providers.service.js')
+    svc._resetAuthProvidersCache()
+
+    const { buildPublic } = await import('../helpers/server.js')
+    const app = await buildPublic()
+    try {
+      const res = await app.inject({ method: 'GET', url: '/api/shared/auth-providers' })
+      expect(res.statusCode).toBe(200)
+      const body = res.json()
+      expect(body.success).toBe(true)
+      expect(body.data.google.enabled).toBe(false)
+      expect(body.data.apple.enabled).toBe(false)
+      expect(body.data.phone.enabled).toBe(true)
+    } finally {
+      await app.close()
+    }
+  })
+
+  it('returns enabled:true for google + apple when all env vars are set', async () => {
+    process.env.GOOGLE_OAUTH_CLIENT_ID = 'id'
+    process.env.GOOGLE_OAUTH_CLIENT_SECRET = 'secret'
+    process.env.APPLE_OAUTH_CLIENT_ID = 'apple-id'
+    process.env.APPLE_OAUTH_TEAM_ID = 'team'
+    process.env.APPLE_OAUTH_KEY_ID = 'key'
+    process.env.APPLE_OAUTH_PRIVATE_KEY = 'priv'
+
+    const svc = await import('../../src/services/auth-providers.service.js')
+    svc._resetAuthProvidersCache()
+
+    const { buildPublic } = await import('../helpers/server.js')
+    const app = await buildPublic()
+    try {
+      const res = await app.inject({ method: 'GET', url: '/api/shared/auth-providers' })
+      expect(res.statusCode).toBe(200)
+      const body = res.json()
+      expect(body.data.google.enabled).toBe(true)
+      expect(body.data.apple.enabled).toBe(true)
+      expect(body.data.phone.enabled).toBe(true)
+    } finally {
+      await app.close()
+    }
+  })
+})