fix(security): HTML-escape OAuth callback error param (GHSA-6v2r-2m4r-768m)

[nictuku]

Fixes the reflected XSS reported in GHSA-6v2r-2m4r-768m.

The bug

_handle_oauth_callback interpolated the error query parameter straight into an HTML error page via an f-string. Any page in the user's browser could navigate to http://localhost:8080-8089/callback?error=<script>... during the 180-second authorization window and execute script on the localhost origin.

Changes

• html.escape() the error value (capped at 200 chars) before reflecting it. The message is still shown to the user, just entity-encoded.
• Every callback response now carries Content-Security-Policy: default-src 'none', X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: no-referrer and Cache-Control: no-store. The success page's inline window.close() script runs under a per-response nonce rather than loosening the policy.
• Removed the /token endpoint. It was unreferenced anywhere in the codebase (auth.py reads token_container directly) and handed the stored OAuth auth_code to any same-origin page — i.e. the escalation target named in the advisory's attack chain.
• Dropped the now-unused quote and json imports.

Drive-by fix

The success branch always returned a 500: asyncio.get_event_loop() raises RuntimeError in the callback server's worker thread because no event loop is ever set there, so the authorization code was never stored. Swapped to time.monotonic() (the timestamp field is not read anywhere). This surfaced while testing the success-page CSP.

Tests

New tests/test_callback_server_xss.py runs a real CallbackHandler on an ephemeral port and asserts the advisory's PoC payload no longer reaches the response, attribute-breakout payloads are encoded, truncation applies, the headers are set, the success page's script is nonced, and /token returns 404 without the auth code.

Full suite: 546 passed, 9 skipped.

Reported by zx (@manus-pi).