Multi-tab PKCE collision causes invalid grant on slower tab

[ryota-murakami]

Summary

Concurrent OAuth flows in multiple tabs clobber the Supabase code-verifier cookie.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

Tab A mid-refresh + Tab B clicking "Sign in with GitHub" can clobber the Supabase sb-…-code-verifier cookie, causing "invalid grant" on the slower tab's /auth/callback.

Fix

Detect "code verifier mismatch" specifically in callback and treat as recoverable (silent restart) rather than surfacing the raw error.

Acceptance

• Slower tab does not show raw "invalid grant" error
• Recoverable case triggers silent restart
• Test reproduces multi-tab collision