fix(auth): harden OIDC flow, token validation, session, and bearer handling

- replay entry covers exp + clock-skew window; callback GET-only (RFC 6749)
- callback rate-limit returns 429 + Retry-After; panic-recovery sets no-store
- cross-chunk integrity for chunked tokens; bounded chunked-token read scan
- HTTPError classification so 5xx/429 token-endpoint responses retry
- redaction of token/code/state in logs; per-source external auth gate

requeststate.go

@@ -32,12 +32,12 @@ type requestState struct {
 	// (Save, Clear, etc.) still have access.
 	session *SessionData
 
-	authenticated     bool
-	accessToken       string
-	idToken           string
-	refreshToken      string
-	userIdentifier    string
-	createdAtUnixSec  int64
+	authenticated    bool
+	accessToken      string
+	idToken          string
+	refreshToken     string
+	userIdentifier   string
+	createdAtUnixSec int64
 
 	// Output: scheme/host/redirect path determined at top of ServeHTTP.
 	scheme      string