Obligatory first comment: This entire model is impossible to do securely. If the server is malicious/compromised, it will serve the user JS that steals any secrets the attacker wants to know and sends them (to the server or somewhere else) without the user ever knowing. You need something that sources its code locally, like a client app or browser extension, if you want client-side encryption to provide any real security.
Unfortunately, OAuth (especially with third-party identity providers) is a really bad fit for this situation. The usual way client-side encryption with a remote back-end works is that the client hashes the user's password twice (in different ways / with different salts), and passes one to the server for authentication and uses the other to derive / decrypt the user's master encryption key. Since the user doesn't actually have any password for your site, and the passwords they do have are entered on a third-party site using code you don't control, this obviously doesn't work for you.
I don't see any way you can have a secret that is known to the user but not to either the server or to an attacker, short of adding an additional "unlock" password on your app post-authentication. The OAuth server doesn't return any value that the client could usefully use to derive a secret, especially not one that the server doesn't also know.
Your best bet might just be to store the encryption key in the user DB, or possibly in an HSM which only the server can acces, and store the encrypted data somewhere else (S3 or something). That's even less security than the normal attempts at this - an attacker who compromises the server can decrypt everything without changing anything at all, certainly without changing any code that the client sees - but if you can keep the keys and the data in separate locations then at least you are secure against somebody compromising one location but not the other (and not the server that bridges them). That's at least slightly better than storing the keys right next to the data, in which case the encryption adds no security at all and is merely a very tiny speed bump.