* 🔐 fix: Redirect OAuth Browser Navigations Instead of Rendering JSON
The /oauth/* routes are reached by top-level browser navigation, so a
middleware that rejects one with a JSON body makes the browser render
that body as the page. Hitting the login rate limit during a social
sign-in dropped the user on a blank page showing:
{"message": "Too many login attempts, please try again after 5 minutes."}
Mark those requests with markOAuthNavigation and have the two middlewares
that can reject them answer with a redirect to the login page carrying an
error code the client localizes. The login limiter stays a single instance
so the attempt budget is still shared with POST /api/auth/login, and that
route keeps its JSON 429 for the SPA.
* 🧪 fix: Address PR Review Bot Findings
chatgpt-codex-connector:
- Split the inline `type TranslationKeys` specifier out of the value
import, per the standalone `import type` convention in CLAUDE.md. This
also clears the Static checks import-sort failure.
- Cover the new OAuth error branches in Login.spec.tsx: each mapped
`?error=` code raises its localized toast and the query is cleaned,
and unmapped codes including prototype members raise nothing.
