fix(auth): address second-round review findings

- OAuth-cancel feedback now keys on the live session, not link_uid: ANY
  signed-in cancel (add-another-account via /auth/login, link, or upgrade)
  redirects to /?oauth=cancelled and gets a neutral "Google sign-in was
  cancelled" toast — the add-account path set no marker and was silent, and
  the shared ?link= message wrongly called an upgrade "account linking"
- drop 127.0.0.1 from the dev OAuth host allowlist: only the localhost
  callbacks are registered in the Google console, so a 127.0.0.1 origin now
  falls back to the fixed callback instead of a redirect_uri_mismatch
- Welcome: extract the shared goResend handler (banner CTA + sign-in link) and
  merge the two adjacent signin-only blocks

frontend/src/components/Welcome.tsx

@@ -346,6 +346,12 @@ function AuthCard() {
     setLogin(null);
   };
 
+  // Shared by the expired-link banner CTA and the sign-in "didn't get the email?" link.
+  const goResend = () => {
+    reset();
+    setMode("resend");
+  };
+
   async function onSubmit(e: React.FormEvent) {
     e.preventDefault();
     reset();
@@ -423,13 +429,7 @@ function AuthCard() {
       {verify === "invalid" && (
         <Banner tone="warn">
           {t("welcome.auth.verifyInvalid")}{" "}
-          <button
-            onClick={() => {
-              reset(); // also clears the verify banner (see reset())
-              setMode("resend");
-            }}
-            className="font-semibold text-accent hover:underline"
-          >
+          <button onClick={goResend} className="font-semibold text-accent hover:underline">
             {t("welcome.auth.resendCta")}
           </button>
         </Banner>
@@ -530,22 +530,16 @@ function AuthCard() {
             )}
           </div>
 
-          {/* A verification email can be lost or never arrive, so offer a resend path from sign-in
-              too — not only from the expired-link banner (which needs a broken link to appear). */}
-          {mode === "signin" && (
-            <button
-              onClick={() => {
-                reset();
-                setMode("resend");
-              }}
-              className="mt-2 block w-full text-center text-xs text-muted hover:text-fg"
-            >
-              {t("welcome.auth.resendLink")}
-            </button>
-          )}
-
           {mode === "signin" && (
             <>
+              {/* A verification email can be lost or never arrive, so offer a resend path from
+                  sign-in too — not only from the expired-link banner (needs a broken link to show). */}
+              <button
+                onClick={goResend}
+                className="mt-2 block w-full text-center text-xs text-muted hover:text-fg"
+              >
+                {t("welcome.auth.resendLink")}
+              </button>
               <div className="flex items-center gap-3 my-4 text-[11px] uppercase tracking-wide text-muted">
                 <span className="h-px flex-1 bg-border" />
                 {t("welcome.auth.or")}