Fix OAuth state across Render restarts

[beme08]

What changed

• store OAuth state and the PKCE verifier in a signed, short-lived HttpOnly cookie
• validate the cookie signature, state, and ten-minute expiry at callback time
• add tampering and wrong-state regression coverage
• document the restart-safe OAuth behavior

Why

Render process restarts or instance changes erased the in-memory PKCE verifier between login and GitHub's callback, causing valid users to receive Invalid OAuth state.

Impact

An authorization in progress now survives a Render process change without weakening the existing state or PKCE checks. Established user sessions remain server-side and unchanged.

Validation

• npm test — 9 passed
• npm run build — passed
• npm run smoke — passed
• git diff --check — passed