feat: ensure account is present

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

app/controllers/oauth_callback_controller.rb

@@ -84,7 +84,10 @@ class OauthCallbackController < ApplicationController
   def account_from_signed_id
     raise ActionController::BadRequest, 'Missing state variable' if params[:state].blank?
 
-    GlobalID::Locator.locate_signed(params[:state])
+    account = GlobalID::Locator.locate_signed(params[:state])
+    raise 'Invalid or expired state' if account.nil?
+
+    account
   end
 
   def account