Document the required /oauth2callback redirect_uri path

Login appeared to succeed (no error) but st.user.is_logged_in never
became True. Root cause: Streamlit only processes the OAuth code
exchange at the hardcoded /oauth2callback route, but redirect_uri was
set to the bare app URL, matching what was already registered in
Google Cloud Console. Google therefore redirected back to the plain
home page, whose normal route silently ignores the leftover code/state
query params, so the auth cookie never gets set. Fixed local
secrets.toml and documented that both the Google Cloud OAuth client's
authorized redirect URIs and AUTH_REDIRECT_URI need the /oauth2callback
suffix. Verified by inspecting the real /auth/login redirect Location
header end-to-end.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -40,7 +40,12 @@ click through.
 
 ### One-time Google Cloud setup
 1. Create an OAuth 2.0 **Web application** Client ID; add your app's URL(s)
-   as authorized redirect URIs (e.g. `http://localhost:8501` for local dev).
+   **with the `/oauth2callback` path** as authorized redirect URIs (e.g.
+   `http://localhost:8501/oauth2callback` for local dev, and
+   `https://<your-space>.hf.space/oauth2callback` for a deployed Space).
+   Streamlit only processes the OAuth code exchange at that exact path --
+   a bare app URL without `/oauth2callback` will silently fail to complete
+   login (no error, but `st.user.is_logged_in` never becomes `True`).
 2. On the OAuth consent screen, add every player's Google account email
    under **Test users** (keep publishing status as "Testing" -- this avoids
    Google's verification review entirely for `drive.file`, a scope that
@@ -51,7 +56,7 @@ click through.
 ### Local dev — `.streamlit/secrets.toml` (gitignored, never commit this)
 ```toml
 [auth]
-redirect_uri = "http://localhost:8501"
+redirect_uri = "http://localhost:8501/oauth2callback"
 cookie_secret = "<random string>"
 client_id = "<oauth client id>"
 client_secret = "<oauth client secret>"
@@ -68,4 +73,5 @@ prompt = "consent select_account"
 `.streamlit/secrets.toml` at startup from individual Space secrets (Settings →
 Variables and secrets), so nothing sensitive needs to live in the repo or the
 image: `AUTH_CLIENT_ID`, `AUTH_CLIENT_SECRET`, `AUTH_COOKIE_SECRET`,
-`AUTH_REDIRECT_URI` (your Space's public URL).
+`AUTH_REDIRECT_URI` (your Space's public URL **with `/oauth2callback`
+appended**, e.g. `https://randomcatlover-boardgames-tracker.hf.space/oauth2callback`).