#3930 Add LinkedIn as a login provider

Let operatives sign in and sign up with LinkedIn, alongside Google, GitHub, Discord and Microsoft.

Feasibility

Possible with what's installed. better-auth 1.4.18 (deno.json) ships a built-in linkedin social provider (@better-auth/core/dist/social-providers/linkedin). It uses LinkedIn's OpenID Connect sign-in (default scopes openid profile email, userinfo at https://api.linkedin.com/v2/userinfo) and reads the email_verified claim, which matters because LinkedIn would join trustedProviders for email-based account linking.

What it touches

• LinkedIn developer app: create one and add the "Sign In with LinkedIn using OpenID Connect" product. Redirect URL https://swamp-club.com/api/auth/callback/linkedin, plus localhost for dev.
• Secrets: LINKEDIN_CLIENT_ID / LINKEDIN_CLIENT_SECRET in the prod swamp-club-env secret and the compose environment: block. Unset means the button is hidden, as with the other providers.
• lib/auth.ts: add linkedin to socialProviders and socialProviderEnabled.
• lib/account-linking-guard.ts: add "linkedin" to SOCIAL_PROVIDERS, which also feeds accountLinking.trustedProviders. Confirm email_verified is honoured before trusting it for linking.
• islands/SignInForm.tsx, islands/SignUpForm.tsx, islands/ConnectedAccounts.tsx: add the button and the connect/disconnect row, plus a LinkedIn icon in components/SocialIcons.tsx.
• lib/app/resolve-linked-accounts.ts, lib/infrastructure/http-provider-username-resolver.ts: OIDC gives no public handle or profile URL, so decide what a linked LinkedIn account shows (name only, or not shown under Uplinks).
• Legal copy: content/privacy-policy.md and content/subprocessors.md list the sign-in providers; LinkedIn joins both.

To confirm before starting

LinkedIn developer apps are tied to a company page. Check who can create the app under the swamp-club page, and whether LinkedIn's current process for the OpenID Connect product needs any review or verification step before production use.