🔐 Signing In & Account Access

Three ways to reach the same member account, all on /login and /signup:

• Email + password — the original flow, bcrypt-hashed passwords.
• Google sign-in — OAuth 2.0 authorization-code flow; matches an existing member by verified email (so a password account and a Google sign-in with the same address land on one account) or creates a new one on first use, with the normal signup bonus.
• Cloudflare Turnstile — a bot check required on both forms before either processes; skipped automatically if no site/secret key is configured.

All three are config-gated (blank keys disable Google sign-in or Turnstile without touching code).