fix(account): Google OAuth originating domain + remove legacy Career fields

[rdahis]

Subset of #1057, cut fresh from main as requested — Google login fixes and the migration only.
No Stripe or pricing changes.

What's here

• fix(account): return Google OAuth to the originating frontend domain #1046 fix(account): return Google OAuth to the originating frontend domain.
  Adds a per-environment allowlist of the three sibling frontends (pt → basedosdados.org,
  en → data-basis.org, es → basedelosdatos.org) and honours a redirect_origin sent by the login
  page. The allowlist is what makes this safe: a JWT rides in the redirect URL, so an unvalidated
  origin would be an open redirect that leaks tokens. Backward compatible — when
  redirect_origin is absent or not allowlisted, it falls back to settings.FRONTEND_URL, i.e.
  exactly today's behaviour.
• refactor(account): remove legacy Career.team_old and role_old fields #1048 refactor(account): remove legacy Career.team_old / role_old, with migration
  account/0029_remove_career_team_old_remove_career_role_old.

Deliberately excluded

#1044 (expose Stripe price id) and #1045 (card-country regional price at checkout) stay on
#1057. There is zero file overlap between the two groups — this branch touches no
account_payment/ file — so the split is clean and the two can land independently.

Review notes

• The migration drops two columns. Its dependency 0028_alter_account_uuid is already on
  main, so the chain is intact. Verified that the website frontend references neither
  team_old/role_old nor teamOld/roleOld, so this is invisible to the frontend.
• Both commits cherry-picked onto main with no conflicts; original authorship preserved and
  (cherry picked from …) provenance recorded on each.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request