v0.3.0 — Google OIDC sign-in

App-native Google OIDC sign-in for the dashboard and billing endpoints — Plutus no longer needs an external proxy to be private. Off by default; enable with auth.enabled + a Google OAuth client. Revocable server-side sessions, allow-listed access, per-user org scoping. See docs/auth.md.

Schema v2 (adds sessions, auto-applied). Existing behavior unchanged until configured.

🤖 Generated with Claude Code