fix(auth): address R4 S1 code-review findings

- link/upgrade OAuth cancel now redirects to /?link=cancelled (a channel App.tsx
  surfaces as a toast) instead of the pre-auth /?login=oauth_cancelled banner a
  signed-in user never sees; a plain sign-in cancel is unchanged
- the login banner (suspended / oauth_cancelled) is now state, cleared on the
  first deliberate action like the verify banner — no more stale lingering
- add a "Didn't get the verification email?" resend entry on the sign-in screen
  so a never-arrived verification mail isn't a dead end (was only reachable from
  the expired-link banner)
- unit-test _oauth_redirect_uri (dev-host derive, unknown-host fallback, prod
  ignores the Host header — the injection guard)
- collapse the 5-deep title/button ternaries into Record<Mode,string> maps

frontend/src/App.tsx

@@ -192,6 +192,9 @@ export default function App() {
       void meQuery.refetch();
       setAccountRaw(LS.settingsTab, "account");
       setPage("settings");
+    } else if (result === "cancelled") {
+      // The user backed out at Google's consent screen — nothing changed, just acknowledge it.
+      notify({ level: "info", message: t("settings.account.googleLink.cancelled") });
     } else {
       const key = result === "conflict" || result === "mismatch" ? result : "error";
       notify({ level: "error", message: t(`settings.account.googleLink.${key}`) });