(refactor): flatten the consent-page flow and extract oauth2 error constants

- Hoist the flow out of the 220-line effect into one named function per
  entry branch (grant_id / request_uri / raw client_id), cancelled via a
  run counter instead of a closed-over flag.
- Dedupe the authorize-request param extraction shared by createPAR and
  authorize into readAuthorizeParams(), plus getAccount()/fail() helpers.
- Move error messages and the oauth2_invalid_request exception type into
  a colocated errors.ts.
- Build navigation targets with resolve() to satisfy
  svelte/no-navigation-without-resolve.

Author: ChiragAgg5k