feat: add OAuth2 CSRF state management

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

tests/test_oauth.py

@@ -24,3 +24,35 @@ def test_is_enabled_false_when_no_oauth_key():
 
 def test_is_enabled_false_when_partial_config():
     assert oauth.is_enabled(CFG_PARTIAL) is False
+
+
+import time as time_mod
+
+
+def test_make_state_returns_unique_tokens():
+    s1 = oauth.make_state()
+    s2 = oauth.make_state()
+    assert s1 != s2
+    assert len(s1) == 64  # 32 bytes hex
+
+
+def test_validate_state_valid():
+    state = oauth.make_state()
+    assert oauth.validate_state(state) is True
+
+
+def test_validate_state_consumed_on_use():
+    state = oauth.make_state()
+    oauth.validate_state(state)
+    assert oauth.validate_state(state) is False  # replay rejected
+
+
+def test_validate_state_unknown():
+    assert oauth.validate_state("notastate") is False
+
+
+def test_validate_state_expired(monkeypatch):
+    state = oauth.make_state()
+    # Wind expiry into the past
+    monkeypatch.setitem(oauth._states, state, time_mod.time() - 1)
+    assert oauth.validate_state(state) is False