Add set-google-client-id.sh for the AWS box

Prompts for the OAuth client ID, writes it to /opt/waters-boards/.env,
recreates the app container and prints the sign-in config it reports.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

README.md

@@ -61,6 +61,9 @@ Google only allows sign-in from **https** addresses (or `localhost`), so the app
    - Authorized JavaScript origins: `https://boards.watersmedia.org` (and `http://localhost:3100` for local testing)
    - No redirect URIs are needed.
 5. Copy the **Client ID** (ends in `.apps.googleusercontent.com`) into `GOOGLE_CLIENT_ID` in `.env`.
+   On the AWS box, `deploy/aws/set-google-client-id.sh` does that for you: it prompts for the ID,
+   writes it to `/opt/waters-boards/.env`, recreates the app container and prints the sign-in
+   config the server reports afterwards.
 
 The server checks every Google sign-in itself. It rejects any account outside
 `ALLOWED_DOMAINS` and any email Google hasn't verified.
@@ -224,4 +227,5 @@ deploy/aws/
   docker-compose.yml   The app and Caddy containers, as run on the Lightsail box
   Caddyfile            Caddy config: HTTPS for boards.watersmedia.org, proxy to the app
   deploy.sh            Deploys from a laptop or Gitea: check, copy, rebuild, wait for healthy
+  set-google-client-id.sh   Writes GOOGLE_CLIENT_ID to the box's .env and recreates the app
 ```