fix(auth): address R4 S1 code-review findings

- link/upgrade OAuth cancel now redirects to /?link=cancelled (a channel App.tsx
  surfaces as a toast) instead of the pre-auth /?login=oauth_cancelled banner a
  signed-in user never sees; a plain sign-in cancel is unchanged
- the login banner (suspended / oauth_cancelled) is now state, cleared on the
  first deliberate action like the verify banner — no more stale lingering
- add a "Didn't get the verification email?" resend entry on the sign-in screen
  so a never-arrived verification mail isn't a dead end (was only reachable from
  the expired-link banner)
- unit-test _oauth_redirect_uri (dev-host derive, unknown-host fallback, prod
  ignores the Host header — the injection guard)
- collapse the 5-deep title/button ternaries into Record<Mode,string> maps

frontend/src/i18n/locales/en/settings.json

@@ -78,7 +78,8 @@
       "linked": "Google account linked.",
       "conflict": "That Google account is already linked to a different Siftlode account.",
       "mismatch": "That's a different Google account than the one already linked here. Sign in with the linked one.",
-      "error": "Couldn't link the Google account. Please try again."
+      "error": "Couldn't link the Google account. Please try again.",
+      "cancelled": "Google account linking was cancelled."
     },
     "password": {
       "title": "Password",

frontend/src/i18n/locales/en/welcome.json

@@ -59,6 +59,7 @@
     "resetButton": "Set password",
     "resendButton": "Resend verification",
     "resendTitle": "Resend verification email",
+    "resendLink": "Didn't get the verification email?",
     "createLink": "Create an account",
     "forgotLink": "Forgot password?",
     "backToSignin": "Back to sign in",