refactor(web): harden oauth state store and session writes after review

- Drop the FIFO from oauthStates: consumed states left entries behind, so
  an unrate-limited start/cancel cycle grew the slice without bound.
  Evict by oldest expiry instead — the map alone now bounds memory.
- CreateSession runs INSERT + expiry sweep in one transaction.
- slices.Contains replaces a hand-rolled contains; APIBase typo fixed.
- Stale comments and test paths updated; login hover uses --ember-ink.

backend/internal/web/web.go

@@ -41,7 +41,7 @@ type Handler struct {
 	states   *oauthStates
 	limiter  *session.LoginLimiter
 	// httpClient is the plain stdlib client that talks to Discord. It is not
-	// an injected interface: tests point APIBBase at a stub server instead.
+	// an injected interface: tests point APIBase at a stub server instead.
 	httpClient *http.Client
 }