Login cancel and retry creates broken auth state

## Problem
User cancels GitHub OAuth mid-flow, returns to app, tries to log in again immediately. Second attempt fails with a cryptic error.

## Error
```
OAuth state mismatch. Expected: abc123, Got: null
```

## Root Cause
The OAuth `state` parameter is consumed on the first redirect attempt even if the user cancels. On the second attempt, the state is no longer in storage, causing the mismatch.

## Fix
Clear the stored OAuth state on the /login route whenever the user lands there without completing auth. Reset the state before initiating a new OAuth flow.

Also: Show a cleaner error message if we detect this case instead of the raw 400.

## Notes
- This is a common OAuth UX pitfall, not specific to Supabase
- Add an error boundary around the auth callback page

## Priority
Medium — affects friction but not blocking core flow.