Show OAuth-specific error messages instead of generic 'Sign in failed' toast
Adds cleanError mappings for OAuth failure modes (session deleted,
Database closed, invalid_dpop_proof iat skew, refresh exhaustion, sub
mismatch, Session resume timed out) and routes them through the existing
toast on ChooseAccountForm so users get an actionable message instead of
a raw oauth-client error string.