A test pins the origin connect flows: a state claims once, a short code reveals nothing, and only the starter sees the flow #6903

src/origins/oauth.ts keeps OAuth connect flows. claimFlowByState, targetForShortCode, getFlowFor, flowSecrets and pruneFlows have no test that names them.

Done:

• [ ] test/origins-oauth-flows.test.ts: a flow's state is claimed once; a second claim and an unknown state both answer nothing. The raw state appears nowhere in the flow's row.
• [ ] targetForShortCode gives the same answer for an unknown code, an expired flow and an already-claimed one.
• [ ] getFlowFor gives the flow to its starter and nothing to anyone else.
• [ ] pruneFlows(db, now) drops finished and expired flows with their secrets, and keeps the live one.

This is a new test file only. Change code only where the test finds a hole, and say so in the pull. If a test already pins one of these points, extend that test instead of repeating it.

Files: test/origins-oauth-flows.test.ts

Before pushing: bun x tsc --noEmit and the test you add. Tests pass now in and never read the wall clock.