Count consumed pending states against the bound

A consumed state left the map at once but stayed in the queue until it
expired, so starting and completing flows grew the queue past the bound.
The bound now counts the queue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/auth_test.go

@@ -889,11 +889,12 @@ func TestPendingStates(t *testing.T) {
 		t.Error("Consume of an unknown state = true")
 	}
 
-	for i := range maxPendingStates {
+	for i := range maxPendingStates - 1 {
 		if err := p.Add(fmt.Sprint("s", i), now); err != nil {
 			t.Fatalf("Add %d: %v", i, err)
 		}
 	}
+	// "first" was consumed but has not expired, so it still counts.
 	if err := p.Add("over", now); !errors.Is(err, ErrTooManyPending) {
 		t.Errorf("Add past the bound = %v, want ErrTooManyPending", err)
 	}