Fix two bugs in the OAuth browser-flow

[pimfeltkamp]

Why

Iter-36 audit of src/auth/browser-flow.ts found two issues. Neither has bitten in normal use because the CLI is alpha and few people have hit the edge cases — but they're both real, one is security-adjacent, and the other is the same body-read total-deadline class we already fixed in the Node SDK (iter 10) and Ruby SDK (iter 19).

Bug 1: state validation runs after the listener responds

Old flow on a state mismatch (e.g. CSRF attempt):

[browser hits /callback?code=X&state=WRONG]
  -> listener sends 200 successPage("✓ Logged in")
  -> listener resolves with { code, receivedState }
[runBrowserFlow]
  -> if (receivedState !== state) throw "state mismatch"

So the user (or attacker) sees "✓ Logged in" in the browser while the terminal simultaneously aborts with state mismatch. Contradictory, and on a real CSRF attempt the attacker sees a success page they shouldn't see.

Fix

Validate state inside the listener handler, before writing the response:

[listener accepts callback]
  -> validate code+state present
  -> validate state matches expected     ← MOVED IN
  -> on mismatch: 400 errorPage("CSRF…") + reject
  -> only on full success: 200 successPage + resolve

Browser and terminal now agree.

Bug 2: token exchange has no deadline

The 5-minute DEFAULT_TIMEOUT_MS only covers listenForCallback. The moment the callback arrives, that timer clears. exchangeCodeForToken then does:

res = await fetch(args.tokenUrl, { method: "POST", … });
const text = await res.text();

No signal, no Request.timeout. If /oauth2/token stalls (slow network, blackholed TCP, Cryptohopper edge issue), the CLI hangs forever. Same class of bug as the body-read deadline gaps we fixed in the Node and Ruby SDKs.

Fix

• Add TOKEN_EXCHANGE_TIMEOUT_MS = 30_000 (matches the SDK's default request timeout).
• Wrap the fetch and the res.text() in a single AbortController whose timer brackets both.
• On abort, throw a clear "timed out reading the response after 30s" error so the user knows what happened (not a generic AbortError).
• clearTimeout lives in a finally so the timer never leaks on the success path.

Test plan

• State-mismatch end-to-end check: hit the local listener with ?state=wrong-state, confirm the CLI rejects with the right error message (verified via tsx reproduction).
• npm run typecheck clean.
• npm run build clean.
• Manual: stand up an HTTP server that accepts the POST then never sends a body, point CRYPTOHOPPER_WEB_URL at it, run cryptohopper login --token (paste-flow doesn't hit the token endpoint — would need a real OAuth flow against a slow staging endpoint to verify the timeout end-to-end).
• Manual: real OAuth flow against staging still works on the happy path.