Missing, expired, or reused OIDC state left users on a JSON error or a generic failure. Map those cases to invalid_state so they get a clear prompt to restart sign-in. Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: Bryan FRIMIN <bryan@frimin.fr>