auth: three OAuth error codes in the map can't actually reach the sign-in page

[Ripwords]

Follow-up from #13. Cosmetic — no user-visible bug, the fallback copy already covers these. Filing so the comment in the file doesn't mislead the next reader.

What

apps/dashboard/shared/auth-redirect.ts has copy for three codes that can never reach the sign-in page, because better-auth hardcodes them to the default error URL (/api/auth/error) rather than the errorCallbackURL we pin:

Code	Where it's thrown	Target
state_mismatch	better-auth/dist/oauth2/state.mjs:39	defaultErrorURL
please_restart_the_process	better-auth/dist/oauth2/state.mjs:40	defaultErrorURL
invalid_callback_request	better-auth/dist/api/routes/callback.mjs:50	defaultErrorURL

The reason is ordering: all three fire while the OAuth state is still being parsed, so parsedData.errorURL — the value carrying our pinned errorCallbackURL — isn't available yet (state.mjs:42 sets it only after the parse succeeds).

Why it's worth a tidy

The file's header comment presents its map as "every code better-auth can emit (magic-link verify, OAuth callback)". That's now accurate for the reachable set (#13 plus b1930b0 filled the gaps), but these three imply a coverage we don't actually have: an OAuth state failure still renders better-auth's bare built-in error page, which is precisely the failure mode #13 set out to eliminate.

Options

• Drop the three entries and note in the comment that state-parse failures land on /api/auth/error and are out of reach.
• Or close the gap properly by setting onAPIError.errorURL to the sign-in page in server/lib/auth.ts, which would make all three reachable and the existing copy correct. Probably the better fix — worth checking whether it has side effects on other API error paths first.

Either way the map and the comment should agree with reality.