Validate and escape OAuth callbacks

[ryanduguid]

Summary

Hardens the local PKCE callback without changing the successful login flow.

• validates the callback state before considering provider errors or codes;
• keeps the loopback listener alive after wrong/missing-state traffic so a later valid callback can succeed;
• returns only fixed browser HTML with a restrictive CSP;
• never reflects error_description in browser or terminal output;
• reports only a strict standard OAuth authorisation error code, otherwise a generic static rejection;
• closes and rejects cleanly on timeout or listen/port errors.

Security impact

This makes the callback state check authoritative and removes the reflected-XSS/privacy path from provider-controlled callback text. Default upstream remains vulnerable until this branch is merged.

Verification at 44e84244c42358099783241250d0417ea6db3af0

• npx vitest run test/lib/oauth.test.ts — 6 passed;
• HTTP-level tests cover wrong and missing state followed by a valid callback, standard/unknown provider codes, secret-like metacharacter descriptions, timeout and occupied-port errors;
• npm run build passed;
• git diff --check passed.

No browser, Xero API or external service was contacted.