I applaud your attempts to properly modularize your app, but I admit that I haven't given this particular problem nearly as much thought as you have. Therefore, I'm not prepared to give you an authoritative answer. What I will offer, however, is my thoughts on the problem. You can take them, leave them, or use them as seed for discussion.
In my simpler view of the problem, I tend to think of Spring Social (esp core and web) as fitting in the web layer. And I tend to put everything else with it there, too. I think that way because the most important thing that Spring Social does is work through the connection process and that's largely a web-level activity.
The problem is approaching this with a "box-arrow-box-arrow-cylinder" view. In such a linear view, we feel we must put certain things in either the web layer, the service layer, or the database layer. But in fact, some things span multiple layers.
The domain, for example truly fits in all three of those layers to some degree. But if we feel we must place them in one layer, then it usually falls into the DB layer by default. Security is another case where the problem spans multiple levels, especially if you're taking advantage of method-level security (and you really should be).
Social integration is another thing that conceptually spans many layers. The API bindings are more of an integration activity and thus best fit in the "cylinder" or DB layer (where "DB" really is just a generic term for integration points where a relational DB is just a common form of integration). But the connection process is certain a web-layer activity, so it fits in the web layer. The lines here are clear, right? Well, no, not really because you configure Spring Social in one place (otherwise, you'd end up duplicating configuration). Therefore, we arrive at your question: Where does the configuration go?
When faced with something that spans multiple layers, I tend to remember that many architecture diagrams aren't as cut-n-dried as "box-arrow-box-arrow-cylinder" and that sometimes there are boxes sitting to the side that are taller and span multiple layers. In other words, I place that layer-spanning concern in its own "box". I would capture the social pieces of my app together as a separate "layer".
However, if I felt strongly compelled (or bound) to the 3-layers, I'd probably configure ConnectController and ProviderSignInController at the web level and everything else in the DB level. I could also argue for it to go to the service level, but that doesn't seem quite right to me, either.
But then again, as I said from the outset, I've not troubled myself too greatly in the context of Spring Social so don't take my thoughts/opinion as authoritative. I'm willing to continue this conversation to see if we can arrive at something more authoritative.
Spring Social Project Lead