fix: /connect ohne Login erreichbar (Anmeldung direkt als technisches Konto), offene Anfragen begrenzt

Claude-Session: https://claude.ai/code/session_01SqzF6qT3TQ8ej3wigEuMSu

tests/test_oauth.py

@@ -166,3 +166,10 @@ def test_callback_error_is_shown(monkeypatch):
     monkeypatch.setattr(unsub, "OAUTH", FakeOAuth())
     r = unsub.app.test_client().get("/oidc/callback?state=s&code=c")
     assert r.status_code == 400 and "expected unsubscribe-bot" in r.get_data(as_text=True)
+
+
+def test_pending_requests_are_bounded(tmp_path):
+    mb = _mb(tmp_path, [])
+    for _ in range(oauth.MAX_PENDING + 15):
+        mb.start()
+    assert len(mb._pending) == oauth.MAX_PENDING