fix: don't alert on expected OAuth session-not-found in callback

[claude]

Fixes #278

Root cause

oauthController.Callback (backend/app/controllers/oauth.controller.go:77) calls gothic.CompleteUserAuth and, on any error, reported it via traceway.CaptureException — which surfaces as a new CRITICAL issue and fires a notification.

The specific error, gothic's "could not find a matching session for this request", is thrown by GetFromSession when the callback request has no matching session value (session.Values["github"] is nil). This is an expected, client-driven condition, not a server fault: the callback was reached without the short-lived session that Begin writes (MaxAge=600 → 10 minutes). It happens when:

• the user takes longer than 10 minutes at the provider before returning,
• the callback URL is replayed / bookmarked / refreshed after the session was consumed (gothic deletes it via defer Logout on success) or expired, or
• an automated scanner hits the public /api/auth/callback/github endpoint directly.

All of these are the OAuth equivalent of a failed/expired login. The user is already handled correctly (redirected to the login error page); the defect is only that the condition was categorized as a server exception, producing false-positive CRITICAL alerts.

Why it's not a functional break

• The happy path is verified correct: Begin writes and commits the session on its 307 redirect (the Transactional middleware commits on 2xx–3xx), and Callback reads and validates it.
• The occurrence is a single, isolated event (count=1, firstSeen == lastSeen) with no correlated DB errors, warn/error logs, distributed trace, or session — a systematic break would produce many occurrences.

Fix

Skip CaptureException for the benign gothic auth failures ("could not find a matching session for this request" and the sibling "state token mismatch", both stale-callback / expired-session / CSRF cases surfaced identically to the user). Still redirect to the login error page in all cases, and still capture genuinely unexpected failures (token exchange, provider errors). Added a unit test for the classification helper.

gothic exposes these as plain errors.New strings with no sentinels, so message matching is the only option; it's contained to one small helper.

Verification

• go build ./app/controllers/ (default and -tags "transactional_pg telemetry_ch")
• go vet ./app/controllers/
• go test ./app/controllers/ ./app/services/ — all pass, including the new TestIsExpectedOAuthAuthError.

View details: /issues/2e16546cedb34a03