What happened

When OpenRouter OAuth falls back to manually pasting the redirect URL, an authorization denial redirect such as:

http://localhost:3000/openrouter-oauth/callback?state=state-1&error=access_denied&error_description=Denied

is parsed as a missing authorization code instead of surfacing the provider error.

Why it matters

Remote/VPS users rely on the manual paste path, and local users can also hit it when the local callback is not detected. In those flows, a denial or provider-side OAuth error should produce the OpenRouter error text after the callback state is verified, not a misleading Missing 'code' parameter message.

Expected behavior

The pasted redirect parser should validate the callback state, then report error / error_description when present.

Actual behavior

The parser checks for code first, so the provider error is masked by Missing 'code' parameter in redirect URL.