fix(extensions): expire stale pending auth challenges

A pending verification challenge lived in a process-global map with no
timestamp, so a challenge created while the app was backgrounded (and
never completed) was served again verbatim on the next attempt - sending
the user to an already-expired CAPTCHA page that needed a second request.

Stamp PendingAuthRequest with CreatedAt at every writer and make
ensureExtensionPendingAuthRequest discard entries older than 5 minutes,
starting a fresh signed-session verification instead.

go_backend/exports_extensions.go

@@ -597,7 +597,13 @@ func ensureExtensionPendingAuthRequest(extensionID string) *PendingAuthRequest {
 	}
 
 	if req := GetPendingAuthRequest(extensionID); req != nil {
-		return req
+		if time.Since(req.CreatedAt) < pendingAuthRequestTTL {
+			return req
+		}
+		// The cached challenge is stale (e.g. verification was requested
+		// while the app was backgrounded and never completed); serving it
+		// would send the user to an expired page. Start a fresh one.
+		ClearPendingAuthRequest(extensionID)
 	}
 
 	manager := getExtensionManager()

go_backend/extension_runtime.go

@@ -59,8 +59,13 @@ type PendingAuthRequest struct {
 	ExtensionID string
 	AuthURL     string
 	CallbackURL string
+	CreatedAt   time.Time
 }
 
+// Challenge URLs are short-lived; serving one past this age sends the user
+// to an already-expired verification page.
+const pendingAuthRequestTTL = 5 * time.Minute
+
 var (
 	pendingAuthRequests   = make(map[string]*PendingAuthRequest)
 	pendingAuthRequestsMu sync.RWMutex

go_backend/extension_runtime_auth.go

@@ -78,6 +78,7 @@ func (r *extensionRuntime) authOpenUrl(call goja.FunctionCall) goja.Value {
 		ExtensionID: r.extensionID,
 		AuthURL:     authURL,
 		CallbackURL: callbackURL,
+		CreatedAt:   time.Now(),
 	}
 	pendingAuthRequestsMu.Unlock()
 
@@ -369,6 +370,7 @@ func (r *extensionRuntime) authStartOAuthWithPKCE(call goja.FunctionCall) goja.V
 		ExtensionID: r.extensionID,
 		AuthURL:     fullAuthURL,
 		CallbackURL: redirectURI,
+		CreatedAt:   time.Now(),
 	}
 	pendingAuthRequestsMu.Unlock()
 

go_backend/extension_signed_session.go

@@ -494,6 +494,7 @@ func (r *extensionRuntime) startSignedSessionVerification(config SignedSessionCo
 			ExtensionID: r.extensionID,
 			AuthURL:     authURL,
 			CallbackURL: config.CallbackURL,
+			CreatedAt:   time.Now(),
 		}
 		pendingAuthRequestsMu.Unlock()
 	}