fix(auth): accept a verified non-primary GitHub email, not just primary+verified (#14)

GitHub sign-in refused to complete whenever the account's primary email
was unverified, even if a different, verified address existed on the
same account. That's a real, common GitHub state (e.g. mid-way through
changing your primary) - reported in #2 as a raw 'no verified primary
email' failure with no way through.

'verified' is what actually attests ownership for auto-linking; 'primary'
is just GitHub's own default-address pick. Prefer primary+verified, but
fall back to any verified email instead of refusing outright.

Also hardens the callback route: consumeState() could throw (e.g. a
Redis hiccup) before the try/catch that turns every other failure in
this flow into a graceful #error= redirect, so that specific failure
mode fell through to the router's generic unhandled-error page instead.
Moved it inside the try. This is a plausible but unconfirmed contributor
to the Google failure also reported in #2 - flagged as such in the PR,
not claimed as a confirmed fix, since I have no server-side logs to
confirm root cause there.

Fixes #2 (GitHub half, confirmed root cause + fix + regression test).
Google half: the app-code path is otherwise sound (errorUrl always
redirects gracefully wherever it's reached), the raw 'Error: Server
Error / try again in 30 seconds' page doesn't match this app's own
error handling - a real diagnosis needs server-side logs I don't have
access to.