Track Google-only login policy

The shared clients now offer Google as their only identity provider, so
assert exactly {Google} rather than {COGNITO, Google}, and update the
policy docs: username/password authentication is no longer reachable.

Author: alexeygrigorev

README.md

@@ -18,7 +18,8 @@ and GitHub/CloudFormation IAM roles.
 
 ## Policy
 
-- Administrator-created Cognito username/password users are allowed.
+- Google is the only supported identity provider. Every app client offers
+  Google sign-in only; username/password authentication is not reachable.
 - Google identities must have a verified `@datatalks.club` email address.
 - The restriction is enforced on both first federated signup and every later
   Google authentication. A Google `hd` hint is not an authorization boundary.

docs/google-auth-setup.md

@@ -103,10 +103,12 @@ The automated verifier requires AWS access but no user credentials:
 uv run --with boto3 python scripts/verify_deployment.py --live
 ```
 
-It checks that all five Cognito application clients enable `COGNITO` and
-`Google`, their callback/logout registrations match `config/clients.json`, each
-Google authorization request reaches `accounts.google.com`, the deployed guard
-allows a verified `@datatalks.club` address and rejects another domain, and no
+It checks that all five Cognito application clients enable `Google` as their
+only identity provider, their callback/logout registrations match
+`config/clients.json`, the Google provider maps the `email` and `email_verified`
+claims the guard reads, each Google authorization request reaches
+`accounts.google.com`, the deployed guard allows a verified `@datatalks.club`
+address and rejects both another domain and a missing `email_verified`, and no
 disposable Codex test users remain.
 
 Then use private browser windows for the two human checks:

scripts/verify_deployment.py

@@ -56,7 +56,7 @@ def verify_live():
         deployed = cognito.describe_user_pool_client(
             UserPoolId=pool, ClientId=client["client_id"]
         )["UserPoolClient"]
-        assert set(deployed["SupportedIdentityProviders"]) == {"COGNITO", "Google"}
+        assert set(deployed["SupportedIdentityProviders"]) == {"Google"}
         assert client["callback_url"] in deployed["CallbackURLs"]
         assert client["logout_url"] in deployed["LogoutURLs"]