[P1] OAuth state key collision — shared `session['oauth_state']` across all three flows

[ShadowWalkerNC]

Summary

All three OAuth flows (Facebook, Google, TikTok) write their nonce to the same session key:

session['oauth_state'] = secrets.token_urlsafe(32)

Impact

If a user opens two OAuth tabs simultaneously (e.g., connecting Facebook and Google at the same time), the second flow overwrites the first's nonce. The first callback will then fail CSRF validation and the OAuth connection will silently break.

Fix

Namespace the key per platform:

session[f'oauth_state_{platform}'] = secrets.token_urlsafe(32)
# And validate:
if state != session.pop(f'oauth_state_{platform}', None):
    abort(400)

Effort: ~30 minutes

Part of full audit: #1