fix(web): clear the step-up retry on redirect handoff; justify the voids

Copilot round 4:

- the EMA `interactive` arm kept `pendingStepUpRetryRef`, on a comment
  claiming it was "still on its way to a redirect". That is wrong twice:
  `prepareOAuthRedirect` returns before the navigation is resolved, so a
  pre-navigation failure leaves the operation for a later, unrelated
  step-up to re-run; and the full-page navigation destroys the closure on
  the success path anyway. It now clears the ref, matching the standard
  step-up below.
- the two surviving `void (async () => …)()` sites now state why the
  caller cannot await, as AGENTS.md requires — the comments had described
  only what the catch handles.
- the `randomUUID` fallback test restored an own descriptor that never
  existed (it is inherited from `Crypto.prototype`), leaving an own
  `randomUUID: undefined` that would push every later test in the file
  onto the fallback path. It deletes the temporary property instead, and
  asserts the global is a function again afterwards.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Quk1hBUtyhkXowwMXzAnAY
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/lib/oauthResume.test.ts

@@ -473,10 +473,17 @@ describe("oauthResume", () => {
       expect(token).toEqual(expect.any(String));
       expect(clearOwnOAuthResumeSnapshot(token)).toBe(true);
     } finally {
+      // `randomUUID` is inherited from `Crypto.prototype`, so there is
+      // normally no OWN descriptor to put back — restoring only when one
+      // existed would leave the `undefined` own property in place and force
+      // every later test in this file onto the fallback path.
       if (original) {
         Object.defineProperty(globalThis.crypto, "randomUUID", original);
+      } else {
+        delete (globalThis.crypto as { randomUUID?: unknown }).randomUUID;
       }
     }
+    expect(globalThis.crypto.randomUUID).toEqual(expect.any(Function));
   });
 
   it("clearOAuthResumeSnapshot swallows removeItem failures", () => {