Selective cookie blocking breaks GitHub OAuth callback

## Problem
Users hitting /auth/callback after GitHub OAuth were being silently redirected back to /login with no error shown.

## Root Cause
Identified via ChatGPT debug session: Supabase sets the auth session cookie during the OAuth callback. In browsers with strict cookie policies (Firefox ETP set to "Strict", Brave with Shields up), this cookie is classified as third-party because the callback domain is on Supabase's infrastructure before being redirected back to our domain.

## Reproduction Steps
1. Open Firefox, set Enhanced Tracking Protection to "Strict"
2. Click "Login with GitHub" on VCTRL
3. Authorize on GitHub
4. Get redirected back — observe silent loop back to /login

## Fix Investigated
- Option A: Use PKCE flow (Supabase supports this) — keeps everything first-party
- Option B: Custom domain for Supabase auth so cookies are same-origin
- Option C: Detect the failure and show a user-facing error with instructions to allow cookies

## Decision
Implement PKCE flow as primary fix. Add fallback cookie error detection for Option C as safety net.

## Status
PKCE branch in progress. ETA: 2 days.