Error message reflection in /login?error=...

[ryota-murakami]

Summary

Raw rateLimitResult.error and oauthError.message are reflected into redirect URLs.

Source

P2 follow-up from /ship adversarial review of PR #176 (silent GitHub token refresh).

Details

route.ts:80,124 reflect rateLimitResult.error and oauthError.message via encodeURIComponent to a redirect URL.

Fix

Emit fixed error codes only (rate_limited, oauth_failed); keep messages in server logs / Sentry.

Acceptance

• No raw error messages in /login?error=...
• Stable error codes documented
• Tests assert only canonical codes appear in URLs