Sweep expired OAuth2 state entries, cap the map at 10000 entries, and remove stale state on failed callback validation. Co-authored-by: Cursor <cursoragent@cursor.com>
jamesread