[Gorka Gonzalo (d0ubl3g)]

The page the browser shows at the end of hodeishield login was unstyled English text, unlike the consent screen before it.

Change

• New auth/callback_page.rs renders the success, denied, failed, mismatched-state and not-found pages.
• The language follows the browser's Accept-Language (q-values honoured): English, Spanish, German, French, Italian or Basque, with English as the fallback.
• One inline stylesheet that follows the system light or dark preference, an inline SVG mark, one heading, a lang attribute and a "you can close this window" line.
• No script, no font and no outside request. The Content Security Policy is default-src 'none' with the stylesheet allowed by its hash, plus base-uri 'none', form-action 'none' and frame-ancestors 'none'.
• Nothing from the request (query parameters, error text) is written into the page.
• A provider error other than access_denied now answers 400 Bad Request instead of 200 OK.

Tests

• Unit tests for language negotiation, every page in every language, the policy hash, the statuses and the absence of network references.
• A loopback test that checks status, policy, lang and headline in two languages, and that nothing from the request is reflected.

cargo fmt --check, cargo clippy --workspace --all-targets -D warnings, cargo xtask codegen --check and cargo test --workspace pass (383 tests).