fix(auth): address second-round review findings

- OAuth-cancel feedback now keys on the live session, not link_uid: ANY
  signed-in cancel (add-another-account via /auth/login, link, or upgrade)
  redirects to /?oauth=cancelled and gets a neutral "Google sign-in was
  cancelled" toast — the add-account path set no marker and was silent, and
  the shared ?link= message wrongly called an upgrade "account linking"
- drop 127.0.0.1 from the dev OAuth host allowlist: only the localhost
  callbacks are registered in the Google console, so a 127.0.0.1 origin now
  falls back to the fixed callback instead of a redirect_uri_mismatch
- Welcome: extract the shared goResend handler (banner CTA + sign-in link) and
  merge the two adjacent signin-only blocks

frontend/src/App.tsx

@@ -192,9 +192,6 @@ export default function App() {
       void meQuery.refetch();
       setAccountRaw(LS.settingsTab, "account");
       setPage("settings");
-    } else if (result === "cancelled") {
-      // The user backed out at Google's consent screen — nothing changed, just acknowledge it.
-      notify({ level: "info", message: t("settings.account.googleLink.cancelled") });
     } else {
       const key = result === "conflict" || result === "mismatch" ? result : "error";
       notify({ level: "error", message: t(`settings.account.googleLink.${key}`) });
@@ -202,6 +199,15 @@ export default function App() {
     stripUrlParams();
   }, []); // eslint-disable-line react-hooks/exhaustive-deps
 
+  // A Google OAuth flow started while already signed in (add-another-account, link, or upgrade) was
+  // cancelled at Google's consent screen. The backend only emits this for a live session, so a
+  // neutral toast is the right feedback — the pre-auth login banner would never render here.
+  useEffect(() => {
+    if (new URLSearchParams(window.location.search).get("oauth") !== "cancelled") return;
+    notify({ level: "info", message: t("settings.account.googleCancelled") });
+    stripUrlParams();
+  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+
   // Deep-link from the "new access request" admin email (?admin=access-requests) → jump straight to
   // the admin Users → Access requests view. Snapshot the param so the pre-login URL strip doesn't
   // drop it; act once `me` is known, and only for an admin (others just land on their default page).

frontend/src/components/Welcome.tsx

@@ -346,6 +346,12 @@ function AuthCard() {
     setLogin(null);
   };
 
+  // Shared by the expired-link banner CTA and the sign-in "didn't get the email?" link.
+  const goResend = () => {
+    reset();
+    setMode("resend");
+  };
+
   async function onSubmit(e: React.FormEvent) {
     e.preventDefault();
     reset();
@@ -423,13 +429,7 @@ function AuthCard() {
       {verify === "invalid" && (
         <Banner tone="warn">
           {t("welcome.auth.verifyInvalid")}{" "}
-          <button
-            onClick={() => {
-              reset(); // also clears the verify banner (see reset())
-              setMode("resend");
-            }}
-            className="font-semibold text-accent hover:underline"
-          >
+          <button onClick={goResend} className="font-semibold text-accent hover:underline">
             {t("welcome.auth.resendCta")}
           </button>
         </Banner>
@@ -530,22 +530,16 @@ function AuthCard() {
             )}
           </div>
 
-          {/* A verification email can be lost or never arrive, so offer a resend path from sign-in
-              too — not only from the expired-link banner (which needs a broken link to appear). */}
-          {mode === "signin" && (
-            <button
-              onClick={() => {
-                reset();
-                setMode("resend");
-              }}
-              className="mt-2 block w-full text-center text-xs text-muted hover:text-fg"
-            >
-              {t("welcome.auth.resendLink")}
-            </button>
-          )}
-
           {mode === "signin" && (
             <>
+              {/* A verification email can be lost or never arrive, so offer a resend path from
+                  sign-in too — not only from the expired-link banner (needs a broken link to show). */}
+              <button
+                onClick={goResend}
+                className="mt-2 block w-full text-center text-xs text-muted hover:text-fg"
+              >
+                {t("welcome.auth.resendLink")}
+              </button>
               <div className="flex items-center gap-3 my-4 text-[11px] uppercase tracking-wide text-muted">
                 <span className="h-px flex-1 bg-border" />
                 {t("welcome.auth.or")}

frontend/src/i18n/locales/en/settings.json

@@ -78,9 +78,9 @@
       "linked": "Google account linked.",
       "conflict": "That Google account is already linked to a different Siftlode account.",
       "mismatch": "That's a different Google account than the one already linked here. Sign in with the linked one.",
-      "error": "Couldn't link the Google account. Please try again.",
-      "cancelled": "Google account linking was cancelled."
+      "error": "Couldn't link the Google account. Please try again."
     },
+    "googleCancelled": "Google sign-in was cancelled.",
     "password": {
       "title": "Password",
       "setHint": "A password is set. You can sign in with your email and password.",

frontend/src/i18n/locales/hu/settings.json

@@ -78,9 +78,9 @@
       "linked": "Google-fiók összekapcsolva.",
       "conflict": "Ez a Google-fiók már egy másik Siftlode-fiókhoz van kapcsolva.",
       "mismatch": "Ez nem az a Google-fiók, amely ide már össze van kapcsolva. Az összekapcsolttal jelentkezz be.",
-      "error": "Nem sikerült összekapcsolni a Google-fiókot. Próbáld újra.",
-      "cancelled": "A Google-fiók összekapcsolása megszakadt."
+      "error": "Nem sikerült összekapcsolni a Google-fiókot. Próbáld újra."
     },
+    "googleCancelled": "A Google-belépés megszakadt.",
     "password": {
       "title": "Jelszó",
       "setHint": "Van beállított jelszó. Bejelentkezhetsz e-mail-címmel és jelszóval.",