Validate and escape OAuth callbacks

[ryanduguid]

Summary

Hardens the local PKCE callback without changing the successful login flow.

• validates the callback state before considering provider errors or codes;
• keeps the loopback listener alive after wrong/missing-state traffic so a later valid callback can succeed;
• returns only fixed browser HTML with a restrictive CSP;
• never reflects error_description in browser or terminal output;
• reports only a strict standard OAuth authorisation error code, otherwise a generic static rejection;
• closes and rejects cleanly on timeout or listen/port errors.

Security impact

This makes the callback state check authoritative and removes the reflected-XSS/privacy path from provider-controlled callback text. Default upstream remains vulnerable until this branch is merged.

Verification at 6dd2b030c73c8da57f006a4d679eb1e28c715f95

• npm ci — succeeded;
• npx vitest run test/lib/oauth.test.ts — 6/6 passed;
• npm test — 136/136 passed across 9 files;
• npm run build passed;
• git diff --check main...HEAD passed;
• HTTP-level tests cover hostile wrong/missing-state traffic followed by a valid callback, standard and unknown provider codes, synthetic secret-like metacharacter descriptions, timeout and occupied-port errors.

No browser, Xero API or external service was contacted.