fix(auth): tighten bridge claim protocol

backend/src/auth/session-store.ts

@@ -609,6 +609,9 @@ function claimOidcState(directory: string, filename: string): OidcStateClaim | u
     before = fileIdentity(lstatSync(statePath) as Stats);
   } catch (error) {
     if (isNotFound(error)) return undefined;
+    // A winner can install its hard-link after the first claim check and before this state
+    // identity check. That process owns the state; this contender must fail closed as used.
+    if (oidcClaimExists(directory, filename)) return undefined;
     throw invalid();
   }
   try {