OIDC login has no state or PKCE (WEB-006) #268

Moved from REVIEW-ISSUES.md (WEB-006), found in the review of uat at a828e1e on 2026-11-07.

Files: src/utils/keycloak.ts:15, src/pages/appeal.tsx:125, src/pages/appeal.tsx:392
Needs: matching change in the API behind /api/v2/keycloak/token (not in this repo)

Problem. The authorization request sends no state and no code_challenge, and /appeal?code=… exchanges any code it is given. An attacker can log a victim in as the attacker's account (login CSRF). Tokens live in sessionStorage, so any XSS can read them. The avatar URL from the API is put into a CSS url() unescaped (ProfileButton.tsx:142).

Fix. Generate a random state and a PKCE verifier (base64url from crypto.getRandomValues; randomString.ts is not suitable, it emits characters PKCE forbids), store both in sessionStorage, send state + S256 code_challenge, verify state on return and pass code_verifier to the token endpoint. Quote and validate the avatar URL.

Related: #208 (ban appeal fixes) and #266 (WEB-031 (#266), ban-appeal login).

Same files as #267, #286 — Auth (keycloak.ts, ProfileButton.tsx, appeal.tsx). Take them together or one after another.