Browser auth callbacks still returned JSON or used one-off pages for several refusal reasons. Route OIDC email verification, magic-link, and SAML ACS failures through /auth/error with stable error codes so users always see an explanation. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>