fix(state): log a digest of the OAuth state instead of the raw value

[allen0099]

Closes #107

Problem

StateManager logged the raw state, which comes straight from the OAuth callback query string:

• consume_state() logged an unknown or expired state at WARNING, so a caller could embed CR/LF and write forged lines into the logs.
• Valid state tokens ended up in production logs.
• A malformed stored entry was logged twice at ERROR with a traceback. The pydantic validation error in that traceback echoed the stored data, including the state.

Change

• Every log line identifies the state by state_ref, the first 12 hex characters of its SHA-256. An operator can compute it from a known state to find the matching lines.
• consume_state() logs an unknown or expired state at INFO instead of WARNING.
• _decode_state() no longer logs. Its callers (consume_state, validate_state, get_state_metadata) log a malformed entry once, at WARNING, without exc_info. consume_state() still raises StateDataError.
• docs/STATE.md notes describe the logging behaviour, and there is a CHANGELOG entry under Fixed.

Not breaking: no public signature changes. Only log levels and log content change.

Tests

The new tests in tests/state/test_manager.py fail on the old code and pass with this change:

• no raw state and no CR/LF in any record across the create, validate, consume and delete paths, including a forged state;
• unknown or expired states stay below WARNING;
• a malformed entry produces exactly one WARNING with no traceback, for each of consume, validate and metadata.

Full suite with live Redis and Memcached: 759 passed. The docs build passes with --strict.