fix(oauth): await callback completion before returning success

[shaun0927]

Summary

This is a narrow follow-up to #509 (and adjacent to the earlier OAuth callback work in #431 / #432).

The callback server still returned an Authorization Successful page before the asynchronous callback validation / token-exchange path had actually completed. That could leave users looking at a success page while the flow failed in an unhandled rejection afterward.

This patch makes the callback response follow the actual callback outcome: it now awaits onCallback(url) and returns an error page if callback processing throws.

Related issues

• Fixes OAuth callback handler still returns success before async validation completes #509
• Follow-up to fix(oauth): preserve full callback URL for token exchange + persist Google Client ID #431 / Google OAuth shows 'invalid response encountered' after successful browser authorization #432

Changes

• apps/x/apps/main/src/auth-server.ts
  • make the HTTP callback handler await onCallback(url)
  • return the existing success page only after callback processing succeeds
  • return an error page when callback processing throws
  • keep the existing full-callback-URL behavior intact

Why this scope

I kept the change in auth-server.ts only so it corrects the false-success / unhandled-rejection path without changing the broader OAuth flow or provider-specific logic.

Testing

1. cd apps/x && pnpm install && pnpm run deps
2. cd apps/main && npm run build
3. Re-ran the source-backed failure harness against the patched branch:

{
  "status": 200,
  "bodyIncludesSuccess": false,
  "bodyIncludesFailure": true,
  "events": []
}