Changes
PR #2279 by pcbeingused333: fix: keep the Codex login waiting after a callback with the wrong state
- Kept the Codex OAuth login waiting when a callback arrives with the wrong state, answering it with 400 instead of ending the pending login.
- Added a regression test for a callback with a mismatched state followed by a valid one.