fix(oauth): remove internal error message from redirect URL

Remove the 'message' query parameter that exposed raw error.message
content (potentially database errors, function names, or internal
details) in the redirect URL. The generic 'CALLBACK_FAILED' error
code is sufficient for the frontend, and detailed errors are still
logged server-side.

Co-Authored-By: Claude <noreply@anthropic.com>

Author: theothersideofgod

graphql/server/src/middleware/oauth.ts

@@ -567,7 +567,6 @@ export function createOAuthRoutes(opts: ConstructiveOptions): Router {
 
       const errorUrl = new URL(errorRedirectPath, getBaseUrl(req));
       errorUrl.searchParams.set('error', 'CALLBACK_FAILED');
-      errorUrl.searchParams.set('message', error.message || 'Unknown error');
       errorUrl.searchParams.set('provider', provider);
       return res.redirect(errorUrl.toString());
     }