No Expiry Cleanup for Stale OAuth State Entries (Memory Leak)

## Issue: FINDING-276 - No Expiry Cleanup for Stale OAuth State Entries (Memory Leak)

**Labels:** bug, security, priority:low, asvs-level:L2

**ASVS Level(s):** L2

**Description:**

### Summary
Expired state entries are only cleaned up when specifically looked up during a callback. If a user initiates an OAuth flow but never completes the callback, the state entry remains in the dictionary indefinitely until process restart, causing gradual memory growth. With ~200 bytes per entry, 1000 abandoned flows would leak ~200 KB. This is a resource leak rather than a security vulnerability, but could impact long-running processes in high-traffic scenarios.

### Details
In `src/asfquart/generics.py` at line 40 and lines 87-93, expired state entries are only cleaned up on lookup, not proactively.

### Recommended Remediation
Implement periodic cleanup mechanism.

**Option 1:** Add async background task that runs every 5 minutes to clean expired states:
```python
async def _cleanup_expired_states():
current_time = time.time()
expired = [s for s, d in pending_states.items() if d['timestamp'] < (current_time - workflow_timeout)]
for state in expired:
pending_states.pop(state, None)
```

**Option 2:** Probabilistic cleanup on each request (e.g., 10% of requests trigger cleanup).

**Option 3:** Migrate to Redis with automatic TTL-based expiry.

### Acceptance Criteria
- [ ] Periodic cleanup mechanism implemented
- [ ] Memory leak eliminated
- [ ] Long-running processes maintain stable memory usage
- [ ] Unit tests verify cleanup logic

### References
- Source reports: L2:10.4.7.md
- Related findings: FINDING-272
- ASVS sections: 10.4.7

### Priority
Low