fix: Callback bestätigt direkt statt Weiterleitung (Sitzung gehört danach dem technischen Konto)

Claude-Session: https://claude.ai/code/session_01SqzF6qT3TQ8ej3wigEuMSu

tests/test_oauth.py

@@ -139,3 +139,30 @@ def test_index_shows_connect_when_not_connected(monkeypatch):
     monkeypatch.setattr(unsub, "OAUTH", FakeOAuth())
     html = unsub.app.test_client().get("/").get_data(as_text=True)
     assert 'action="/connect"' in html and 'action="/result"' not in html
+
+
+def test_callback_confirms_without_redirect(monkeypatch):
+    import app as unsub
+
+    class FakeOAuth:
+        def finish(self, state, code):
+            assert (state, code) == ("s", "c")
+
+    monkeypatch.setattr(unsub, "OAUTH", FakeOAuth())
+    r = unsub.app.test_client().get("/oidc/callback?state=s&code=c")
+    assert r.status_code == 200 and "connected" in r.get_data(as_text=True)
+
+
+def test_callback_error_is_shown(monkeypatch):
+    import app as unsub
+
+    class FakeOAuth:
+        def finish(self, state, code):
+            raise oauth.OAuthError("Signed in as philipp@example.org, expected unsubscribe-bot@example.org")
+
+        def connected(self):
+            return False
+
+    monkeypatch.setattr(unsub, "OAUTH", FakeOAuth())
+    r = unsub.app.test_client().get("/oidc/callback?state=s&code=c")
+    assert r.status_code == 400 and "expected unsubscribe-bot" in r.get_data(as_text=True)