Handle GitHub OAuth failures in /auth/callback without a 500

[tarekziade]

What

A user hit Internal Server Error on https://serge.huggingface.tech/login today. The OAuth roundtrip got through the token exchange but GitHub rejected the freshly-issued token on GET /user:

POST github.com/login/oauth/access_token  → 200 OK
GET  api.github.com/user                   → 401 Unauthorized  ("Bad credentials")
GET  /auth/callback?...                     → 500 Internal Server Error

auth_callback called user_resp.raise_for_status(), so the 401 bubbled up as an unhandled httpx.HTTPStatusError → bare 500 with no logging of why.

Change

Each GitHub step in the callback (token exchange, /user, and the org-membership-derived allow-list check) now:

• logs GitHub's own status + response body (so we can diagnose the next failure), and
• redirects to /login?error=<code> instead of raising.

login.html maps the code to a readable message:

• github_auth_failed — "GitHub couldn't verify your sign-in. This is usually temporary — please try again."
• invalid_oauth_state — expired/reused sign-in link
• not_allowed — account not on the allow-list

Testing

Drove the real 401 path with a FastAPI TestClient + mocked GitHub responses: the /user 401 now yields 302 → /login?error=github_auth_failed (no 500), and the log line reads oauth /user lookup failed: github returned 401: {"message":"Bad credentials"}. ruff format/check clean; no tests referenced the old error strings.

Note: the underlying 401 on a just-minted token is most likely transient (or an OAuth App client_secret drift) — this PR is the UX/robustness fix so it surfaces cleanly instead of a 500.

🤖 Generated with Claude Code