Concurrent OAuth handshake collision in dashboards

# F2 — Concurrent OAuth handshake collision (nr-launcher)

**Fixes for users:** the intermittent dashboard "Forbidden" where a reload sometimes works — the symptom most customers actually report.

## Cause

passport-oauth2 stores the OAuth `state` in one per-session slot (`oauth2:`), and the auth middleware gates every asset. A single dashboard load fires ~5 parallel requests → ~5 handshakes clobber the one slot → all but the last fail state verification → Forbidden. It's a race, so a reload sometimes wins. nr-launcher-only bug; the dashboard's parallel chunk loading just amplifies it.

## Fix

Give the strategy a custom state store (passport-oauth2 supports it) that keys each handshake by a nonce carried in the `state` param, instead of the shared host key. Lives entirely in the existing `lib/auth/strategy.js`. No passport or dashboard changes.

Start in lib/auth/strategy.js and review how the existing passport-oauth2 strategy stores and verifies OAuth state. Reproduce or inspect the parallel dashboard requests, then confirm that each handshake is separated by its nonce and that concurrent loads no longer produce intermittent Forbidden responses.

Written by the indexing model from the issue text.