OAuth callback errors now distinguish state-mismatch from missing-code

Error messages shown during OAuth device or browser sign-in were rewritten to detect a specific case: when a pasted callback URL actually belongs to a different, unrelated sign-in attempt (called a state mismatch), rather than just lacking an authorization code. In that case, the message now tells the user to retry using the URL from the specific sign-in flow that's still open.