If I put
<meta name="robots" content="noindex,nofollow" />
in auth.php and include auth.php inside login.php page, the login.php page will not appear on Google or only auth.php won't appear?
Search engines have no insight into your PHP files. The only thing that matters is which HTML gets generated for which URL.
Every HTML document that has
meta-robots element head element¹ conveys that noindex and nofollow should apply for it. But note that this could be overwritten by the HTTP header X-Robots-Tag and/or by additional meta-robots elements in the same document.
¹ If the meta-robots element is somewhere else than in the head element, it’s invalid, and it might not work.