- Add signIn callback: on Google sign-in, check users table by email;
create new user (provider='google', provider_account_id, name/image
from profile) if not found, or allow sign-in for returning users
- Update jwt callback to look up DB uuid by email for Google sign-ins,
so token.id is always the DB uuid rather than the Google sub ID
- Mark task 3.3 as complete in tasks.md
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>