`after-user-created` hook fires on every external OAuth sign-in, not just on account creation

[swithek]

Bug report

• I confirm this is a bug with Supabase, not with my own application.
• I confirm I have searched the Docs, GitHub Discussions, and Discord.

Describe the bug

The after-user-created Auth hook is documented to run once, after a new user is created. For external OAuth providers (GitHub, Google, etc.) it instead runs on every sign-in.

In the OAuth callback (internal/api/external.go), createdUser = true is set unconditionally, discarding the AccountLinkingDecision. That branch handles every OAuth sign-in, so the hook also fires for AccountExists (a returning user) and LinkAccount (a new identity linked to an existing user).

Only the external OAuth path is affected; the equivalent call sites in token_oidc.go, web3.go and samlacs.go all gate the hook on decision == models.CreateAccount.

To Reproduce

1. Configure an after-user-created HTTP hook.
2. Enable any external OAuth provider, e.g. GitHub.
3. Sign in with a new GitHub account → hook fires once.
4. Sign out, sign in with the same account again → hook fires again for the same user.

Expected behavior

The hook fires exactly once per user, when the account is created, matching the docs ("added after a user is created") and the behavior of the OIDC, Web3 and SAML sign-in paths.

Screenshots

N/A

System information

• Service: supabase/auth, self-hosted and hosted
• Affected versions: v2.181.0 (where the hook was introduced, feat: add after-user-created hook #2169) through current master
• OS / Browser / supabase-js / Node.js: N/A (server-side bug)

[swithek]

I already have a PR with a fix open and ready to be merged: #2656. It also has regression tests. Is that something that you could review @cstockton @xlgmokha ?