Fixes #6028. Stacked on #6031 (base branch will auto-update to `main` once #6031 merges).

Problem

`pkg/api/handlers/auth.go` stored OAuth CSRF state tokens in an in-memory `map[string]time.Time`. If the backend restarted between `/auth/login` (where the state is generated and the user is redirected to GitHub) and `/auth/github/callback` (where the state must be validated), the map was gone and every in-flight user hit `csrf_validation_failed`.

Fix

Persist OAuth state in the backing store so in-flight flows survive restarts, as long as the user completes them within `oauthStateExpiration` (10 minutes, unchanged).

• New table `oauth_states (state PRIMARY KEY, created_at, expires_at)` with an index on `expires_at`, added to `pkg/store/sqlite.go` `migrate()` next to `revoked_tokens`.
• Store interface gains three additive methods:
  • `StoreOAuthState(state, ttl)`
  • `ConsumeOAuthState(state) (bool, error)` — single transaction that `SELECT`s, `DELETE`s, and returns whether the row existed and had not expired. Always deletes so a row cannot be reused even on the expired/invalid path.
  • `CleanupExpiredOAuthStates() (int64, error)`
• auth.go:
  • Removed the global `oauthStateStore` map, its `sync.RWMutex`, the package-level `init()` goroutine, `purgeExpiredOAuthStates`, and `inlineCleanupThreshold`.
  • `storeOAuthState` / `validateAndConsumeOAuthState` are now methods on `*AuthHandler` delegating to the store.
  • `NewAuthHandler` starts a per-handler cleanup ticker (`oauthStateCleanupInterval = 5m`) that calls `CleanupExpiredOAuthStates`.
  • `GitHubLogin` now returns `oauth_state_store_failed` if the DB write fails (new, narrow error path).
• MockStore in `pkg/test/mock_store.go` gains overridable implementations of all three methods.

Tests

• `pkg/store/oauth_states_test.go` — round-trip, single-use semantics, unknown state, expired state (including rejection on retry), bulk cleanup, and a reopen-the-same-SQLite-file restart test.
• `pkg/api/handlers/auth_test.go` — three new tests using a real `SQLiteStore`:
  • `TestOAuthStatePersistence_RoundTrip`
  • `TestOAuthStatePersistence_SurvivesRestart` — instantiates two `AuthHandler`s against the same DB file to simulate the restart scenario from bug: oauth login fails if backend restarts during authentication flow #6028
  • `TestOAuthStatePersistence_InvalidStateRejected`
• Fixed `TestGitHubLogin_Redirects` to pass a real store instead of `nil` (storeOAuthState now requires one).

Verification

```
go build ./... # clean
go vet ./... # clean
go test ./pkg/store/... ./pkg/api/handlers/... # PASS
cd web && npm run build # PASS
```

Notes

• No magic numbers — all intervals/TTLs go through the existing `oauthStateExpiration` / `oauthStateCleanupInterval` constants.
• No other handlers in `auth.go` were touched.
• The DB-backed approach is consistent with the existing `revoked_tokens` pattern added for token revocation.