fix(api): add PUT /api/settings/{key} endpoint and shared credentials for Google/Microsoft social login

- Add PUT /{key} endpoint to settings API with SettingValueUpdate body model (only
  requires value, key comes from URL path) — fixes 405 Method Not Allowed errors
  from the admin Connections wizard which used PUT to save settings
- Fix grey toggles on /admin/connections: they appeared grey because all saves were
  silently failing with 405; now saves succeed and toggles reflect actual state
- Add social_auth_google_use_global_credentials config field and auth.py logic to
  reuse google_drive_client_id/google_drive_client_secret for Google Sign-In
- Add social_auth_microsoft_use_global_credentials config field and auth.py logic to
  reuse onedrive_client_id/onedrive_client_secret for Microsoft Sign-In
- Also apply consistent both-field check for Dropbox global credentials fallback
- Add settings metadata entries for the two new boolean settings
- Add Google and Microsoft settings_keys to admin_connections service definitions
- Add JS visibility toggle logic for Google/Microsoft credential fields in admin UI
- Add 6 new unit/integration tests for PUT endpoint and SettingValueUpdate model

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/ac66041a-2cbd-4d90-8f8e-3588c629d4d8

app/auth.py

@@ -58,11 +58,18 @@ if AUTH_ENABLED and settings.authentik_client_id and settings.authentik_client_s
 
 # --- Social Login Providers ---------------------------------------------------
 if AUTH_ENABLED and settings.social_auth_google_enabled:
-    if settings.social_auth_google_client_id and settings.social_auth_google_client_secret:
+    # Determine which credentials to use for Google social login
+    _google_client_id = settings.social_auth_google_client_id
+    _google_client_secret = settings.social_auth_google_client_secret
+    if settings.social_auth_google_use_global_credentials and not (_google_client_id and _google_client_secret):
+        _google_client_id = settings.google_drive_client_id
+        _google_client_secret = settings.google_drive_client_secret
+
+    if _google_client_id and _google_client_secret:
         oauth.register(
             name="google",
-            client_id=settings.social_auth_google_client_id,
-            client_secret=settings.social_auth_google_client_secret,
+            client_id=_google_client_id,
+            client_secret=_google_client_secret,
             server_metadata_url="https://accounts.google.com/.well-known/openid-configuration",
             client_kwargs={"scope": "openid profile email"},
         )
@@ -72,12 +79,21 @@ if AUTH_ENABLED and settings.social_auth_google_enabled:
         logger.warning("SOCIAL_AUTH_GOOGLE_ENABLED=true but client ID/secret not configured")
 
 if AUTH_ENABLED and settings.social_auth_microsoft_enabled:
-    if settings.social_auth_microsoft_client_id and settings.social_auth_microsoft_client_secret:
+    # Determine which credentials to use for Microsoft social login
+    _microsoft_client_id = settings.social_auth_microsoft_client_id
+    _microsoft_client_secret = settings.social_auth_microsoft_client_secret
+    if settings.social_auth_microsoft_use_global_credentials and not (
+        _microsoft_client_id and _microsoft_client_secret
+    ):
+        _microsoft_client_id = settings.onedrive_client_id
+        _microsoft_client_secret = settings.onedrive_client_secret
+
+    if _microsoft_client_id and _microsoft_client_secret:
         tenant = settings.social_auth_microsoft_tenant or "common"
         oauth.register(
             name="microsoft",
-            client_id=settings.social_auth_microsoft_client_id,
-            client_secret=settings.social_auth_microsoft_client_secret,
+            client_id=_microsoft_client_id,
+            client_secret=_microsoft_client_secret,
             server_metadata_url=f"https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration",
             client_kwargs={"scope": "openid profile email"},
         )
@@ -133,7 +149,7 @@ if AUTH_ENABLED and settings.social_auth_dropbox_enabled:
     # Determine which credentials to use for Dropbox social login
     _dropbox_client_id = settings.social_auth_dropbox_client_id
     _dropbox_client_secret = settings.social_auth_dropbox_client_secret
-    if settings.social_auth_dropbox_use_global_credentials and not _dropbox_client_id:
+    if settings.social_auth_dropbox_use_global_credentials and not (_dropbox_client_id and _dropbox_client_secret):
         _dropbox_client_id = settings.dropbox_app_key
         _dropbox_client_secret = settings.dropbox_app_secret