fix: race-condition when authenticating and react strict-mode is active

This only happens in reacts strict mode.

The OIDC callback effect cleared oidc_state_parameter from sessionStorage synchronously right after dispatching the token-exchange thunk, and the codeCallback.pending reducer never transitioned the auth slice to PENDING. Under React.StrictMode the effect runs twice on mount: the second run found the state parameter already gone and isAuthPending still false, fell through to auth.signIn(), and triggered a full-page redirect that aborted the in-flight /token POST. Keycloak's SSO session immediately issued a new authorization code, the callback re-mounted, and the cycle repeated several times until a token POST finished before the next re-mount.

Defer the oidc_state_parameter cleanup to the codeCallback.fulfilled and .rejected reducers so the state parameter survives an in-flight exchange, and set SessionStatus.PENDING in codeCallback.pending so the existing isAuthPending guard in AuthCallbackComponent actually blocks duplicate dispatches of the same authorization code.