fix(auth): align the social-login surfaces with the reference theme

The "other login methods" block drifted from zibll on three axes. Gitee was
mapped to fa-code-branch because FA5 Free ships no Gitee brand glyph, so the
button showed a generic branch icon; Google showed the monochrome FA glyph
instead of the reference's multi-colour mark. The modal also printed an
implicit agreement line under the social buttons, which the reference guest
card does not have. And the top-nav user popover built its own
.social-login-divider / .oauth-row / .oauth-btn markup and then wrapped that
in a second separator and .social_loginbar, so the block rendered nested and
unlike the reference.

aksrt_brand_icon() now routes zibsvg-/customsvg- values through the shared
icon renderer, and the brand map resolves gitee to zibsvg-gitee and google to
zibsvg-google-color. Both sprite keys already exist in the runtime symbol
sheet, which the loader pulls in on every frontend page. Because
get_auth_providers_data() and binding_row() both go through
aksrt_brand_icon(), one map change fixes the icon on the modal, the user card,
the top-nav popover, the user-center binding list and the profile social
links.

render_social_buttons() is rewritten to the reference shape: an optional
.social-separator, a .social_loginbar, and one .social-login-item <type>
toggle-radius anchor per enabled provider with rel="nofollow" and a
"<label>登录" title. oauth_button_lg switches to the button-lg variant with a
label, and the WeChat entry carries qrcode-signin so auth.js opens the QR
panel instead of navigating, matching the reference. The navbar and the link
apply modal now append the block verbatim instead of re-wrapping it, and the
user-card loop adopts the same item attributes. The retired
.social-login-divider / .oauth-row / .oauth-btn rules are dropped from
base-1.css, and the binding-list icon rule gains an svg selector so the
sprite icons keep the 22px the FA glyphs had.

Verification: node --test across widget-system, navigation, admin,
asset-ledger, dev, front-submit and visual (613 tests), plus php -l on every
changed PHP file. Extended the auth source contract with the agreement-line,
brand-icon and popover-structure cases, and pinned the user-card guest
markup.

inc/helpers/aksrt-icons.php

@@ -42,7 +42,7 @@ endif;
 
 if (!function_exists('aksrt_brand_icon_map')) :
 /**
- * Short key → FA5 class string (allowlisted).
+ * Short key → FA5 class string or built-in SVG sprite key (allowlisted).
  *
  * @return array<string, string>
  */
@@ -52,10 +52,12 @@ function aksrt_brand_icon_map(): array {
 		return $map;
 	}
 
-	// FA5 Free has no bilibili/gitee brands — use solid stand-ins.
+	// FA5 Free ships no Gitee brand glyph and no multi-colour Google mark, so
+	// those two resolve to the theme's built-in SVG sprite (zibsvg-*) instead of
+	// a solid stand-in; every other key stays on FA5.
 	$map = [
 		'github'    => 'fa fab fa-github',
-		'google'    => 'fa fab fa-google',
+		'google'    => 'zibsvg-google-color',
 		'x'         => 'fa fab fa-twitter',
 		'twitter'   => 'fa fab fa-twitter',
 		'email'     => 'fa fas fa-envelope',
@@ -73,7 +75,7 @@ function aksrt_brand_icon_map(): array {
 		'instagram' => 'fa fab fa-instagram',
 		'web'       => 'fa fas fa-globe',
 		'globe'     => 'fa fas fa-globe',
-		'gitee'     => 'fa fas fa-code-branch',
+		'gitee'     => 'zibsvg-gitee',
 		'baidu'     => 'fa fas fa-paw',
 		'alipay'    => 'fa fab fa-alipay',
 	];
@@ -127,10 +129,10 @@ endif;
 
 if (!function_exists('aksrt_brand_icon_class')) :
 /**
- * Resolve a short key or FA class string to an allowlisted FA5 class.
+ * Resolve a short key, FA class string or sprite key to its icon value.
  *
- * @param string $name Short key or full FA class string.
- * @return string e.g. 'fa fab fa-github', or '' if unknown.
+ * @param string $name Short key, full FA class string or zibsvg-/customsvg- value.
+ * @return string e.g. 'fa fab fa-github' or 'zibsvg-gitee', or '' if unknown.
  */
 function aksrt_brand_icon_class(string $name): string {
 	$raw = trim($name);
@@ -138,6 +140,12 @@ function aksrt_brand_icon_class(string $name): string {
 		return '';
 	}
 
+	// Built-in SVG sprite and inline SVG values pass straight through; they are
+	// not FA class strings and must survive to the markup renderer untouched.
+	if (preg_match('/^(?:zibsvg|customsvg)-/i', $raw)) {
+		return $raw;
+	}
+
 	// Pass through already-valid full FA class strings (footer contact_more).
 	if (preg_match('/^fa\s+(?:fas|far|fab)\s+fa-[\w-]+(?:\s+fa-[\w-]+)*$/i', $raw)) {
 		// Prefer mapped short key when strip matches our catalog (normalizes weixin etc.).
@@ -164,14 +172,21 @@ endif;
 
 if (!function_exists('aksrt_brand_icon')) :
 /**
- * Escaped FA <i> markup for a brand/contact icon.
+ * Escaped markup for a brand/contact icon (FA5 <i> or built-in SVG sprite).
  *
- * @param string       $name          Short key or FA class string.
+ * @param string       $name          Short key, FA class string or zibsvg-/customsvg- value.
  * @param array|string $extra_classes Optional extra classes.
  * @return string Safe HTML or empty string when unknown.
  */
 function aksrt_brand_icon(string $name, $extra_classes = []): string {
 	$class = aksrt_brand_icon_class($name);
+
+	// Sprite and inline-SVG values carry their own element, so the shared icon
+	// renderer owns the markup (it emits <svg class="icon"><use …>).
+	if (strpos($class, 'zibsvg-') === 0 || strpos($class, 'customsvg-') === 0) {
+		return aksrt_icon_markup($class, $extra_classes);
+	}
+
 	if ($class === '') {
 		return '';
 	}