Vipps Auth Screen — deep-link callback and error handling

The deep-link handler should be a StreamProvider or a global stream that the VippsAuthStateNotifier subscribes to via ref.listen. When the notifier receives the stream event it cancels the timeout timer, validates the CSRF state, and proceeds to token exchange. Structure error types as a sealed class or enum so the UI can switch exhaustively over all cases without a catch-all that silently swallows unexpected states. The Retry action on the error UI should call notifier.reset() which sets state back to idle without navigating — the user then re-taps the CTA button.

This ensures a fresh CSRF state is generated for each attempt. Do not use context.go/pushReplacement directly inside the widget's error handling — instead observe the VippsAuthState in a ref.listen and trigger navigation from there, keeping the navigation logic out of error-handler callbacks. For Supabase session storage: after successful token exchange, call VippsAuthService.persistSession() which writes to Supabase auth and triggers the onAuthStateChange listener used by the root router guard.

Unit tests for VippsAuthService: (1) valid callback with matching state → token exchange called; (2) callback with mismatched state → error emitted, no token exchange called; (3) callback with error=access_denied → cancellation error emitted; (4) token exchange network timeout → networkFailure error emitted. Widget tests: (1) simulate a successful deep-link arrival and assert navigation occurs; (2) simulate cancellation callback and assert error message text is displayed and Retry button is present; (3) tap Retry and assert screen returns to idle state; (4) tap Cancel and assert router pops back to method selector. Accessibility test: use Flutter's SemanticsController to assert the error message widget has liveRegion set to true. Security test: assert no authorization code appears in any print/log output (via log capture in test).