- Drop the FIFO from oauthStates: consumed states left entries behind, so
an unrate-limited start/cancel cycle grew the slice without bound.
Evict by oldest expiry instead — the map alone now bounds memory.
- CreateSession runs INSERT + expiry sweep in one transaction.
- slices.Contains replaces a hand-rolled contains; APIBase typo fixed.
- Stale comments and test paths updated; login hover uses --ember-ink.
sulthan
1a7e130f9f