Count consumed pending states against the bound

A consumed state left the map at once but stayed in the queue until it
expired, so starting and completing flows grew the queue past the bound.
The bound now counts the queue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -889,11 +889,12 @@ func TestPendingStates(t *testing.T) {
 		t.Error("Consume of an unknown state = true")
 	}
 
-	for i := range maxPendingStates {
+	for i := range maxPendingStates - 1 {
 		if err := p.Add(fmt.Sprint("s", i), now); err != nil {
 			t.Fatalf("Add %d: %v", i, err)
 		}
 	}
+	// "first" was consumed but has not expired, so it still counts.
 	if err := p.Add("over", now); !errors.Is(err, ErrTooManyPending) {
 		t.Errorf("Add past the bound = %v, want ErrTooManyPending", err)
 	}

internal/auth/cookie.go

@@ -200,7 +200,9 @@ func (p *PendingStates) Add(state string, now time.Time) error {
 		expired++
 	}
 	p.order = p.order[expired:]
-	if len(p.states) >= maxPendingStates {
+	// The bound counts every unexpired state, consumed or not: a consumed
+	// state leaves states at once but order only when it expires.
+	if len(p.order) >= maxPendingStates {
 		return ErrTooManyPending
 	}
 	expires := now.Add(p.ttl)