Add guest/account auth flows, order tracking, and order history UI

- Wire up Better Auth (email/password + Google/Apple SSO) with a
  sign-in/sign-up UI, header account menu, and a basket that follows
  the signed-in-or-guest state.
- Give the order status page a vertical timeline per preparation step
  (with a distinct customer-facing name separate from the machine tag,
  a done/in-progress/queued/pending look, and a sonar-ping highlight on
  the active step), a formatted ETA (relative under 3h, absolute clock
  time beyond that), and Buy again / Get help / Cancel actions.
- Expand Pizza's recipe into 6 steps across a shared prep station and
  the existing oven/assembly stations, with matching schema, seed, and
  domain changes plus updated/added test coverage.
- Add an Orders list (account orders via session, guest orders via a
  locally remembered access-token list) with a shared getOrdersForCustomer
  domain summary, and remember a guest's name/contact after their first
  order so checkout doesn't ask again.
- Improve page transitions with the View Transitions API: a shared
  element morph between an order card and its detail page, a stable
  (non-jumping) header across navigations, and reduced-motion handling.
- Add a Ghost Kitchen wordmark (Space Grotesk, faded "Ghost", ghost
  icon standing in for the "o") and shrink the basket icon to match
  the rest of the header controls.
- Add a run-ghost-kitchen agent skill documenting local setup, the
  dev-server driver, and the gotchas hit along the way.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -69,14 +69,47 @@ npm run db:migrate
 ## Setting up Better Auth
 
 Generate and set the `BETTER_AUTH_SECRET` environment variable in your
-`.env.local`:
+`.env.local`, and make sure `BETTER_AUTH_URL` matches the URL the app is
+actually served from (`http://localhost:3000` in local dev):
 
 ```bash
 npx @better-auth/cli secret
 ```
 
-See the [Better Auth documentation](https://www.better-auth.com) for more on
-configuring authentication.
+Account creation and sign-in live at `/signup` and `/login`, supporting both
+email/password and "Continue with Google" / "Continue with Apple" SSO. The
+SSO buttons only appear once the corresponding provider's credentials are
+set in `.env.local`:
+
+```bash
+GOOGLE_CLIENT_ID=...
+GOOGLE_CLIENT_SECRET=...
+APPLE_CLIENT_ID=...
+APPLE_CLIENT_SECRET=...
+```
+
+Create OAuth credentials in the [Google Cloud Console](https://console.cloud.google.com/apis/credentials)
+and the [Apple Developer portal](https://developer.apple.com/account/resources/identifiers/list/serviceId)
+respectively, with the redirect URI `{BETTER_AUTH_URL}/api/auth/callback/google`
+(swap `google` for `apple`). See the
+[Better Auth documentation](https://www.better-auth.com) for more on
+configuring authentication, and its
+[Google](https://www.better-auth.com/docs/authentication/google) and
+[Apple](https://www.better-auth.com/docs/authentication/apple) provider
+guides for provider-specific setup details.
+
+For Google, `scripts/setup-google-sso.sh` walks you through the Google Cloud
+Console steps interactively and writes the resulting `GOOGLE_CLIENT_ID` /
+`GOOGLE_CLIENT_SECRET` into `.env` for you:
+
+```bash
+./scripts/setup-google-sso.sh
+```
+
+Apple's Sign in with Apple doesn't support `localhost` redirect URIs — you
+need a real HTTPS domain (a deployment or a tunnel like ngrok) registered on
+the Services ID before it's testable, so there's no equivalent script for it
+yet.