docs: clarify OAuth callback setup for GitHub and Google

[mason5052]

Summary

• clarify how PUBLIC_URL is used to build OAuth callback URLs
• document the correct GitHub OAuth App values for Homepage URL and Authorization callback URL
• add matching .env examples for GitHub and Google OAuth in both README.md and backend/docs/config.md

Problem

Issue #219 reports that the OAuth setup docs explain the client ID and secret, but do not explain what to use for the provider-side callback settings.

As a result, users can configure GitHub OAuth credentials and still hit redirect_uri mismatch errors because the required Homepage URL and Authorization callback URL values are not documented.

Solution

Document the callback construction used by PentAGI's router and make the provider configuration explicit:

• Homepage URL = PUBLIC_URL
• Authorization callback URL / Redirect URI = ${PUBLIC_URL}/api/v1/auth/login-callback

This PR also adds concrete .env examples, clarifies that PUBLIC_URL is the public origin/base URL, and notes that Google uses the same PentAGI callback endpoint.

User Impact

Users setting up GitHub or Google OAuth no longer need to infer callback values from the codebase. The required provider configuration is documented directly where the OAuth environment variables are explained.

Closes #219.

Test Plan

• Verified the router builds the callback from PUBLIC_URL, baseURL, and /auth/login-callback in backend/pkg/server/router.go
• Verified the README examples use existing environment variables from .env.example
• Verified backend/docs/config.md matches the current router behavior
• git diff --check

[Copilot]

Pull request overview

Updates the documentation to make OAuth provider-side configuration (GitHub/Google callback settings) explicit, based on how PentAGI constructs redirect URIs from PUBLIC_URL.

Changes:

• Clarifies how PUBLIC_URL is used to construct OAuth callback URLs.
• Documents provider console values (Homepage URL / Redirect URI) for GitHub and Google.
• Adds .env configuration examples for both providers in docs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
backend/docs/config.md	Expands PUBLIC_URL/OAuth configuration guidance and adds provider-side callback setup + env examples.
README.md	Adds explicit GitHub/Google OAuth setup steps and .env examples, emphasizing callback construction.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The callback path referenced here is missing the API base path. In backend/pkg/server/router.go, the redirect URI is built with path.Join(baseURL, "/auth/login-callback") where baseURL is /api/v1, so the provider redirect URI becomes ${PUBLIC_URL}/api/v1/auth/login-callback (not ${PUBLIC_URL}/auth/login-callback). Also note the router overwrites publicURL.Path, so PUBLIC_URL should be an origin (scheme/host/port) without an additional path segment.

[Copilot]

This section instructs configuring the provider redirect URI as ${PUBLIC_URL}/auth/login-callback, but the actual route registered by the router is under the API group (/api/v1/auth/login-callback). Please update the provider configuration bullets and example to match the real redirect URI to avoid continued redirect_uri mismatch errors.

[Copilot]

The documented callback endpoint ${PUBLIC_URL}/auth/login-callback does not match the server route. In backend/pkg/server/router.go, the callback is registered under the /api/v1 group, so the actual redirect URI is ${PUBLIC_URL}/api/v1/auth/login-callback. Please update this block accordingly so users don’t configure the wrong redirect URI.

[Copilot]

These GitHub OAuth setup steps use ${PUBLIC_URL}/auth/login-callback, but the backend registers the callback under /api/v1/auth/login-callback. Please update the Authorization callback URL value to ${PUBLIC_URL}/api/v1/auth/login-callback to align with the actual redirect URI sent by PentAGI.

Suggested change

	3. Set **Authorization callback URL** to `${PUBLIC_URL}/auth/login-callback`.
	3. Set **Authorization callback URL** to `${PUBLIC_URL}/api/v1/auth/login-callback`.

[Copilot]

Similarly for Google OAuth, the redirect URI should include the API base path. The backend callback endpoint is ${PUBLIC_URL}/api/v1/auth/login-callback, not ${PUBLIC_URL}/auth/login-callback; otherwise Google will reject the login with a redirect URI mismatch.