fix(web): terminate the five void-discarded OAuth recovery promises

Each of the five sites in `useOAuthRecovery` discarded a promise with
`void`, satisfying `@typescript-eslint/no-floating-promises` but not the
narrower rule AGENTS.md states — `void` only where the callee owns its
failures or the caller cannot await, with a comment saying which.

Each now picks a user-visible outcome:

- `prepareOAuthRedirect` clears the resume snapshot (so the next load
  cannot read a redirect that never started as an *abandoned* one),
  flags the server and raises the re-auth banner.
- the `authChallengeInteractive` handler flags and banners, where before
  a rejection drew no UI response at all.
- `resumePendingReauth` restores the pending slot and toasts, so the
  next trigger retries the deferred recovery instead of losing it.
- the `/oauth/callback` effect flags and banners what falls between its
  existing arms — the client rebuild and the post-resume scope check.
- `handleStepUpAuthorize`'s EMA branch reports exactly as its `failed`
  outcome arm does; the stored retry gets its own catch, since by then
  the permissions leg succeeded and the failure is the command's.

The two surviving `void`s carry the justification AGENTS.md asks for.

Closes #2165

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Quk1hBUtyhkXowwMXzAnAY
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/core/auth/oauthUx.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect } from "vitest";
 import {
   authRecoveryRestoredMessage,
+  authRecoveryRetryFailedMessage,
   emaStepUpFailureMessage,
   emaStepUpInProgressMessage,
   emaStepUpSuccessMessage,
@@ -208,6 +209,16 @@ describe("oauthUx resume/restore copy", () => {
     );
   });
 
+  it("authRecoveryRetryFailedMessage appends only a non-blank detail", () => {
+    const base =
+      "Could not continue the pending authorization. The Inspector will try again the next time this tab becomes active or the session reconnects.";
+    expect(authRecoveryRetryFailedMessage()).toBe(base);
+    expect(authRecoveryRetryFailedMessage("   ")).toBe(base);
+    expect(authRecoveryRetryFailedMessage(" token endpoint 500 ")).toBe(
+      `${base} (token endpoint 500)`,
+    );
+  });
+
   it("oauthResumeAbandonedMessage reauth is retry-agnostic", () => {
     expect(
       oauthResumeAbandonedMessage("reauth", { recoverySource: "tool" }),