评论登录新增 Google OAuth 与 Telegram Login Widget

- Google：授权码流程（openid email profile），handle 优先用已验证邮箱，头像取 picture
- Telegram：官方 widget 直接回传签名资料，后端按官方算法验签（secret=SHA256(bot_token)，除 hash 外全字段排序比对）+ auth_date 24h 时效
- providers 列表自动按配置下发（未配置的不显示）；widget 型带 bot 用户名
- 三个登录方式共用读者会话与 upsert；Telegram 走 POST 无跳转
- .env.example 补 ONE_GOOGLE_* / ONE_TELEGRAM_* 模板

backend/internal/api/comments.go

@@ -76,16 +76,6 @@ func (a *API) ownerReader() (model.Reader, error) {
 	})
 }
 
-func (a *API) authProviders(w http.ResponseWriter, r *http.Request) {
-	providers := []map[string]any{}
-	if a.GH.Enabled() {
-		providers = append(providers, map[string]any{
-			"id": "github", "label": "GitHub", "kind": "redirect",
-		})
-	}
-	httpx.OK(w, map[string]any{"providers": providers})
-}
-
 func (a *API) authMe(w http.ResponseWriter, r *http.Request) {
 	var user any // 匿名时 {user: null}，前端判空即「未登录」
 	if reader, ok, err := a.resolveReader(r); err == nil && ok {
@@ -158,18 +148,7 @@ func (a *API) githubCallback(w http.ResponseWriter, r *http.Request) {
 		httpx.ServerError(w, err)
 		return
 	}
-	token, _ := a.ReaderSessions.Issue(reader.ID)
-	http.SetCookie(w, &http.Cookie{Name: auth.ReaderCookie, Value: token, Path: "/",
-		HttpOnly: true, SameSite: http.SameSiteLaxMode, MaxAge: int((30 * 24 * time.Hour).Seconds())})
-	// 回到发起登录的前台；没有记录（直接敲 URL 进来的）就回站点根
-	back := a.Cfg.SiteURL
-	if ck, err := r.Cookie(oauthBackCook); err == nil && ck.Value != "" {
-		if u, err := url.Parse(ck.Value); err == nil && (u.Scheme == "http" || u.Scheme == "https") && u.Host != "" && u.Path == "" {
-			back = u.Scheme + "://" + u.Host
-		}
-	}
-	http.SetCookie(w, &http.Cookie{Name: oauthBackCook, Value: "", Path: "/", MaxAge: -1})
-	http.Redirect(w, r, back, http.StatusFound)
+	http.Redirect(w, r, a.issueReaderCookie(w, r, reader.ID), http.StatusFound)
 }
 
 func randHex(n int) string {