Owner-only provider configuration

Create one OAuth application with each provider, register the exact redirect URI shown below, then save its Client ID and Client Secret here. Secrets are encrypted before storage and are never returned to the browser.