Diagnose Xaman callback failures

[xrpbanks]

This draft PR keeps the showcase frozen and isolates the Xaman authentication repair.

Implemented on this branch:

• callback UI surfaces the backend's sanitized error detail instead of collapsing every failure into a generic sign-in error;
• backend validates pending login state before bridge exchange but consumes it only after a successful WordPress/Xaman exchange;
• regression coverage proves a transient bridge failure leaves the state retryable, a retry can succeed, and a later replay is rejected.

Still required before merge:

• CI must run and pass for the branch;
• validate the deployed WordPress/Xaman bridge configuration and shared secret/client ID contract;
• verify end-to-end Xaman -> WordPress bridge -> FastAPI session -> authenticated food logging/retrieval/deletion.

Do not merge until those deployment checks are complete.