fix(frontend): validate oidc state in callback flow

frontend/src/pages/LoginPage.vue

@@ -51,7 +51,13 @@ async function handleOidcLogin() {
     sessionStorage.setItem('post_login_redirect', typeof redirect === 'string' ? redirect : '/me')
     const callbackUrl = `${window.location.origin}/auth/callback`
     const res = await getOidcAuthorizeUrl(callbackUrl)
-    window.location.href = res.data.authorize_url
+    const authorizeUrl = res.data.authorize_url
+    const parsed = new URL(authorizeUrl)
+    const state = parsed.searchParams.get('state')
+    if (state) {
+      sessionStorage.setItem('oidc_expected_state', state)
+    }
+    window.location.href = authorizeUrl
   } catch (err) {
     const detail = err.response?.data?.detail
     if (detail === 'authentik_login_not_configured') {