refactor(web): harden oauth state store and session writes after review

- Drop the FIFO from oauthStates: consumed states left entries behind, so
  an unrate-limited start/cancel cycle grew the slice without bound.
  Evict by oldest expiry instead — the map alone now bounds memory.
- CreateSession runs INSERT + expiry sweep in one transaction.
- slices.Contains replaces a hand-rolled contains; APIBase typo fixed.
- Stale comments and test paths updated; login hover uses --ember-ink.

backend/api_test.go

@@ -557,7 +557,7 @@ func TestLoadConfigDiscord(t *testing.T) {
 	if got := loadConfig().Discord; got.ClientID != "client-1" || got.ClientSecret != "client-secret-1" ||
 		got.GuildID != "guild-1" || got.RequiredRole != "role-9" ||
 		got.RedirectURI != "https://bm.example.com/auth/discord/callback" ||
-		got.APIBBase != "https://stub.example/api" {
+		got.APIBase != "https://stub.example/api" {
 		t.Fatalf("Discord config = %+v, want every field set", got)
 	}
 
@@ -568,8 +568,8 @@ func TestLoadConfigDiscord(t *testing.T) {
 	if got.RequiredRole != "" {
 		t.Fatalf("RequiredRole = %q, want empty by default", got.RequiredRole)
 	}
-	if got.APIBBase != "https://discord.com/api/v10" {
-		t.Fatalf("APIBBase = %q, want the Discord default", got.APIBBase)
+	if got.APIBase != "https://discord.com/api/v10" {
+		t.Fatalf("APIBase = %q, want the Discord default", got.APIBase)
 	}
 }