fix(web): per-attempt snapshot ids, honest recovery copy, connect teardown

Copilot round 3, four items:

- the snapshot "attempt token" was the stored serialization, which is not
  unique: the snapshot records neither the authorization URL nor its
  `state`, so two concurrent redirects for one server with unchanged UI
  serialize identically. `OAuthResumeSnapshot` now carries an optional
  `attemptId`, stamped per write and matched on clear. Optional because
  an older build's snapshot, mid-redirect across an upgrade, has none —
  and treating that as a match would strand a live callback.
- the resume-failure toast promised a retry even when the session had
  ended and nothing was restored. Copy is now chosen by whether anything
  is left pending; `authRecoveryAbandonedMessage` covers the other case.
- a connect-scoped redirect that failed left the connection at
  "connecting" with the active-server lock held, since the redirect was
  what would have ended the attempt. It now disconnects first, as the
  sibling arm in `useConnectionLifecycle` does — scoped to that context,
  because an ambient or step-up failure does not mean the session is dead.
- both terminal EMA step-up failure arms now drop the stored retry. A
  later step-up does not overwrite the ref, so a retained operation could
  be re-run by an unrelated authorization. The `interactive` arm keeps
  it: that one is still on its way to a redirect.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Quk1hBUtyhkXowwMXzAnAY
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/oauthUx.ts

@@ -60,6 +60,20 @@ export function authRecoveryRetryFailedMessage(detail?: string): string {
   return detail?.trim() ? `${base} (${detail.trim()})` : base;
 }
 
+/**
+ * Toast when a deferred authorization recovery fails *and* the session it
+ * belonged to has ended, so nothing was left pending to retry (#2165).
+ *
+ * Distinct from {@link authRecoveryRetryFailedMessage} because promising a
+ * retry the code has explicitly declined to make is worse than saying nothing:
+ * the user waits for something that will never happen.
+ */
+export function authRecoveryAbandonedMessage(detail?: string): string {
+  const base =
+    "Could not continue the pending authorization, and the session it belonged to has ended. Reconnect to authorize again.";
+  return detail?.trim() ? `${base} (${detail.trim()})` : base;
+}
+
 export function oauthResumeAbandonedMessage(
   authKind: OAuthInteractiveAuthKind,
   options?: { recoverySource?: OAuthRecoverySource },