Count consumed pending states against the bound

A consumed state left the map at once but stayed in the queue until it
expired, so starting and completing flows grew the queue past the bound.
The bound now counts the queue.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/auth/cookie.go

@@ -200,7 +200,9 @@ func (p *PendingStates) Add(state string, now time.Time) error {
 		expired++
 	}
 	p.order = p.order[expired:]
-	if len(p.states) >= maxPendingStates {
+	// The bound counts every unexpired state, consumed or not: a consumed
+	// state leaves states at once but order only when it expires.
+	if len(p.order) >= maxPendingStates {
 		return ErrTooManyPending
 	}
 	expires := now.Add(p.ttl)