fix(auth): address R4 S1 code-review findings

- link/upgrade OAuth cancel now redirects to /?link=cancelled (a channel App.tsx
  surfaces as a toast) instead of the pre-auth /?login=oauth_cancelled banner a
  signed-in user never sees; a plain sign-in cancel is unchanged
- the login banner (suspended / oauth_cancelled) is now state, cleared on the
  first deliberate action like the verify banner — no more stale lingering
- add a "Didn't get the verification email?" resend entry on the sign-in screen
  so a never-arrived verification mail isn't a dead end (was only reachable from
  the expired-link banner)
- unit-test _oauth_redirect_uri (dev-host derive, unknown-host fallback, prod
  ignores the Host header — the injection guard)
- collapse the 5-deep title/button ternaries into Record<Mode,string> maps

backend/app/auth.py

@@ -308,9 +308,13 @@ async def callback(
     try:
         token = await client.authorize_access_token(request)
     except OAuthError as exc:
-        # The user cancelled or denied consent at Google — land back on the login page with a
-        # friendly banner instead of a raw 400 JSON error page (applies to sign-in and link flows).
+        # The user cancelled or denied consent at Google — land back with a friendly notice instead
+        # of a raw 400 JSON error page. A link/upgrade cancel is an ALREADY-signed-in user who never
+        # sees the pre-auth login banner, so route it through the ?link= channel App.tsx surfaces as
+        # a toast; a plain sign-in cancel lands on the login page with the oauth_cancelled banner.
         log.info("Google OAuth cancelled/failed: %s", exc.error)
+        if link_uid is not None:
+            return RedirectResponse(url="/?link=cancelled")
         return RedirectResponse(url="/?login=oauth_cancelled")
 
     userinfo = token.get("userinfo")