OAuth callback state-mismatch no longer throws a CSRF error, just ignores the callback

When logging in and manually pasting an OAuth callback URL, if its state parameter doesn't match the login attempt currently in progress, Claude Code used to immediately abort the whole login flow with an error calling it a possible CSRF attack (a type of forged-request attack). Now it logs a quieter debug message saying the callback belongs to a different flow and simply ignores it, continuing to wait for the correct callback instead of throwing an error.