feat: handle replayed OIDC callbacks and improve auth error handling

[vinit-truefoundry]

Note

Medium Risk
Changes OIDC callback redirect logic and frontend auth gating; scoped to replay/stale-error handling with tests, but touches security-sensitive login flows.

Overview
Fixes the case where browser Back after a successful OIDC login replays the callback URL and leaves ?error=login_failed on the address bar even though the user is still authenticated.

Backend (/callback): Before redirecting to /?error=…, the handler now checks an existing session via resolveAuthUser. On state mismatch, IdP error, or failed code exchange, authenticated users are redirected home (or return_to) instead of the error landing.

Frontend: Session probing runs even when ?error= is present, so a valid session is detected instead of skipping the probe. The auth error screen only appears when the session is unauthenticated (shouldShowAuthErrorScreen). After authentication, stale error query params are stripped with history.replaceState via stripAuthErrorSearch.

Unit tests cover the new URL helpers and callback replay paths.

^{Reviewed by Cursor Bugbot for commit 711ad3c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 711ad3c

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@truefoundry/trueforge	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5afb6d1. Configure here.}