fix: address Phase 2 code review findings in oauth.rs
- Add Default impl for AppState delegating to Self::new() to fix clippy::new_without_default warning
- Add documenting comment above .lock().unwrap() in handle_deep_link explaining that panic on poison is intentional and represents a programming error with no safe recovery path