OAuth Test Flows Need a Browser-Binding Check

A practical way to test OAuth browser flows with state, PKCE, and isolated email fixtures that prove the right session completed.