fix(web): isolate OAuth popups per flow across tabs

The popup used a fixed window name ("posthog-code-oauth"), so a second
tab starting sign-in before the first finished could reuse and navigate
away the first tab's popup. The first flow's callback then never fired,
and the shared BroadcastChannel only carried the second flow's state, so
the first tab waited until the five-minute timeout.

Name each popup uniquely per flow (suffixing the per-flow OAuth state) so
concurrent sign-ins open independent windows. State-based callback
routing over the shared channel already delivers each callback to its own
flow.

Generated-By: PostHog Code
Task-Id: d5bcaf27-c54b-45d5-920d-cc4f65c9e9fb

Author: gantoine

apps/web/src/web-oauth-flow.ts

@@ -112,10 +112,13 @@ export class WebOAuthFlowService implements IAuthOAuthFlowService {
         kind === "signup" ? buildSignupUrl(region, authUrl) : authUrl;
 
       // Open before any network round-trip so the click's transient activation
-      // still permits the popup.
+      // still permits the popup. The window name is unique per flow: a fixed
+      // name lets a concurrent sign-in in another tab reuse (and navigate away)
+      // this flow's popup, stranding it until the timeout — its own callback
+      // never fires and the shared channel only carries the other flow's state.
       const popup = window.open(
         target.toString(),
-        "posthog-code-oauth",
+        `posthog-code-oauth-${state}`,
         POPUP_FEATURES,
       );
       if (!popup) {