BankID Auth Screen — callback handling and error states

Map BankID error codes in a dedicated bankid_error_mapper.dart file that converts raw error strings to BankIDError enum values and then to user-facing message strings. This separation makes it easy to add new codes or update copy without touching the notifier or UI logic. The Cancel button must be wired to an async action in the notifier: (1) set state to cancelling (disables button to prevent double-tap), (2) await BankIDAuthService.cancelSession(), (3) emit idle, then (4) signal the router to pop. Use ref.listen in the screen widget to respond to BankIDAuthState.success by navigating — keep navigation out of the notifier.

For the WebView path, implement a NavigationDelegate.onNavigationRequest that detects the redirect URI prefix and hands the URL to BankIDAuthService for parsing rather than allowing the WebView to navigate to it. This prevents the BankID redirect from loading in the WebView and instead routes it through the same callback handler used by deep links. This task is high complexity because BankID has many edge-case error codes and the server-side session cancellation adds async complexity to what appears to be a simple Cancel button — plan thorough testing.

Unit tests for BankIDAuthService: (1) valid callback with correct state → token exchange called, success emitted with personnummer; (2) callback with wrong state → csrfMismatch error emitted, no token exchange; (3) each documented BankID error code maps to the correct BankIDError enum value; (4) cancelSession() calls the BankID API abort endpoint. Widget tests: (1) simulate success callback → assert navigation to PersonnummerConfirmation with correct args; (2) simulate each error type → assert correct message string is displayed; (3) tap Cancel during awaitingCallback → assert cancelSession called and route popped; (4) tap Retry after error → assert state resets to idle; (5) assert error container has Semantics liveRegion true. Security tests: assert personnummer is not present in any captured log output during a success callback simulation. E2E manual test on device: complete a full BankID flow and verify navigation to Personnummer Confirmation; deliberately cancel mid-flow and verify return to method selector.