fix: include error_description in PKCE callback error page

[marcusolsson]

Issue 4 from TODO.md

Keycloak OAuth error responses include both an error code and an error_description. The callback handler only displayed the error code, giving users vague messages like "Authentication failed: access_denied" without actionable context.

Changes

• Extract error_description from the callback query string.
• Concatenate error and error_description for display when both are present.
• Uses ${error}: ${errorDescription} format so the browser HTML page and the resolved error string both include the human-readable explanation.
• Adds 2 regression tests: one with error_description, one without.

Refs: TODO.md Issue 4