fix(auth): address second-round review findings

- OAuth-cancel feedback now keys on the live session, not link_uid: ANY
  signed-in cancel (add-another-account via /auth/login, link, or upgrade)
  redirects to /?oauth=cancelled and gets a neutral "Google sign-in was
  cancelled" toast — the add-account path set no marker and was silent, and
  the shared ?link= message wrongly called an upgrade "account linking"
- drop 127.0.0.1 from the dev OAuth host allowlist: only the localhost
  callbacks are registered in the Google console, so a 127.0.0.1 origin now
  falls back to the fixed callback instead of a redirect_uri_mismatch
- Welcome: extract the shared goResend handler (banner CTA + sign-in link) and
  merge the two adjacent signin-only blocks

frontend/src/App.tsx

@@ -192,9 +192,6 @@ export default function App() {
       void meQuery.refetch();
       setAccountRaw(LS.settingsTab, "account");
       setPage("settings");
-    } else if (result === "cancelled") {
-      // The user backed out at Google's consent screen — nothing changed, just acknowledge it.
-      notify({ level: "info", message: t("settings.account.googleLink.cancelled") });
     } else {
       const key = result === "conflict" || result === "mismatch" ? result : "error";
       notify({ level: "error", message: t(`settings.account.googleLink.${key}`) });
@@ -202,6 +199,15 @@ export default function App() {
     stripUrlParams();
   }, []); // eslint-disable-line react-hooks/exhaustive-deps
 
+  // A Google OAuth flow started while already signed in (add-another-account, link, or upgrade) was
+  // cancelled at Google's consent screen. The backend only emits this for a live session, so a
+  // neutral toast is the right feedback — the pre-auth login banner would never render here.
+  useEffect(() => {
+    if (new URLSearchParams(window.location.search).get("oauth") !== "cancelled") return;
+    notify({ level: "info", message: t("settings.account.googleCancelled") });
+    stripUrlParams();
+  }, []); // eslint-disable-line react-hooks/exhaustive-deps
+
   // Deep-link from the "new access request" admin email (?admin=access-requests) → jump straight to
   // the admin Users → Access requests view. Snapshot the param so the pre-login URL strip doesn't
   // drop it; act once `me` is known, and only for an admin (others just land on their default page).