OAuth Callback Tests Need a State Ledger

A practical OAuth callback test design: bind state and PKCE to a browser session, prevent replay, and keep failure evidence useful without leaking secrets.