Fix CI: sort the new locale section, declare VITE_SAAS_OAUTH_ENABLED

toml-sort: the connect rail's section was inserted before instances rather
than after, so the locale file was no longer alphabetically sorted.

env.test: every VITE_ var read in source must be declared in an example env
file. Documents why it defaults to off rather than just naming it.

frontend/editor/.env.proprietary

@@ -25,3 +25,11 @@ VITE_SAAS_SUPABASE_ANON_KEY=
 # admin's Supabase JWT. Distinct from the local backend (reached same-origin via
 # the editor's vite proxy). Absent -> wallet/billing surfaces stay on the mock.
 VITE_SAAS_API_URL=
+
+# Whether an OAuth sign-in can return to THIS origin during account linking.
+# Supabase only honours a redirect it has been given in its allow-list, and a
+# customer's own hostname will not be, so the round trip would finish on the
+# SaaS site and this instance would never receive a session. Leave empty unless
+# this deployment's origin IS allow-listed on the Supabase project; the Connect
+# flow then offers email and password only, which works everywhere.
+VITE_SAAS_OAUTH_ENABLED=

frontend/editor/public/locales/en-US/translation.toml

@@ -6367,12 +6367,6 @@ description = "Connect your Stirling account to use this. Manual PDF tools keep
 title = "This needs a connected account"
 titleFeature = "{{feature}} need a connected account"
 
-[portal.accountLink.rail]
-cta = "Connect"
-later = "Later"
-sub = "Unlocks teams, the processor, pipelines and policies. Manual PDF editing stays free."
-title = "Connect your Stirling account"
-
 [portal.accountLink.instances]
 active = "Active"
 revoke = "Revoke"
@@ -6421,6 +6415,12 @@ forbidden = "Only the team owner can view the org's linked instances."
 generic = "Couldn't load the team's linked instances. Try again in a moment."
 title = "Couldn't load linked instances"
 
+[portal.accountLink.rail]
+cta = "Connect"
+later = "Later"
+sub = "Unlocks teams, the processor, pipelines and policies. Manual PDF editing stays free."
+title = "Connect your Stirling account"
+
 [portal.accountLink.state]
 free = "Editor plan"
 subscribed = "Processor plan"