fix(auth): a cancel at Google lands where the browser is; the probe says why it refused

A refused session keeps its cookie, so the cancel branch, keyed on the cookie's account, sent a
signed-out browser to the in-app toast the login page never shows: it now asks whether the
session holds. The probe's log line named every refusal 'its account no longer holds'; it now
carries the reason. The pruning docstring says again that a renewal may land a request's time
after the revoke, and the test pins the day of margin. The test clock clamps in the zone asked for.

backend/app/routes/auth.py

@@ -392,9 +392,10 @@ async def callback(
         # or connecting via /auth/google/connect) never sees the pre-auth login banner, so
         # surface a neutral toast via ?oauth=cancelled; a fresh sign-in cancel lands on the login page
         # with the oauth_cancelled banner instead. Keyed on the live session, not on link_uid, so a
-        # sign-in started while signed in (no marker) is covered too.
+        # sign-in started while signed in (no marker) is covered too — a session that still HOLDS:
+        # a refused one keeps its cookie (`auth._session_user`), and its browser is on the login page.
         log.info("Google OAuth cancelled/failed: %s", exc.error)
-        if session_user_id(request) is not None:
+        if optional_current_user(request, db) is not None:
             return RedirectResponse(url="/?oauth=cancelled")
         return RedirectResponse(url="/?login=oauth_cancelled")