fix: harden GitHub OAuth sign-in state/callback handling

[alchip]

Summary

• persist OAuth state from GitHub authorize URL before redirect
• validate callback state against stored expected value
• clear stored OAuth state after success/failure paths
• keep token storage flow consistent in callback login path

Why

Issue #821 requires robust GitHub OAuth sign-in flow. This patch strengthens CSRF/state integrity and callback handling for reliable end-to-end sign-in.

Acceptance mapping

• Sign-in redirects through GitHub authorize with tracked state
• Callback validates state and avoids invalid-session continuation
• Successful callback logs in user and stores tokens/session

Closes #821

Wallet

Wallet: 74jSPYaxEJcGEuW4jr6bqQdg2iuLChyLEuEmC8QhcQVW