OAuth callback leg dead-ends when discovery state is missing (AuthorizationServerMismatchError)

[cliffhall]

Follow-up from #1805 / PR #1806.

PR #1806 fixes the outbound leg — a modern/auto-era connect now starts OAuth instead of surfacing a generic negotiation-failure toast. A separate failure remains on the callback leg of that same flow.

Problem

When a pending authorization has no recorded discovery state, the SDK's SEP-2352 issuer-binding check throws:

AuthorizationServerMismatchError: discoveryState was not available on the callback leg

The Inspector then dead-ends — the user is returned from the authorization server and the connection cannot proceed, with no path forward in the UI. Clearing OAuth state for the server works around it.

Expected

A callback that arrives without recorded discovery state should restart authorization (discover afresh and re-run the flow) rather than dead-ending, or at minimum surface an actionable "authorization state was lost — re-authorize" affordance instead of a terminal error.

Notes

• Related: the issuer round-trip requirements of SEP-2352 (the provider must round-trip the issuer stamp; Zod strips unknown keys) — see core/auth/.
• Reproduce on the modern/auto era path fixed by fix(core): start OAuth on a modern/auto-era connect (#1805) #1806, with OAuth state partially cleared or a callback resumed in a fresh session.
• Needs a decision on which behavior is right (auto-restart vs. explicit re-authorize prompt) before implementing.