fix: harden request handling, pipeline containment, and startup boundaries

backend/app/adapters/spotify/session.py

@@ -17,6 +17,7 @@ class SpotifySession:
     tokens: TokenSet
     account_id: str
     display_name: str
+    refresh_generation: int = 0
     refresh_lock: asyncio.Lock = field(default_factory=asyncio.Lock)
 
 
@@ -51,7 +52,15 @@ class PendingLogins:
 
     def add(self, state: str, code_verifier: str) -> None:
         """Store a PKCE verifier for a newly issued OAuth state."""
-        self._entries[state] = (code_verifier, time.monotonic())
+        now = time.monotonic()
+        expired_states = (
+            pending_state
+            for pending_state, (_, created_at) in self._entries.items()
+            if now - created_at >= PENDING_LOGIN_LIFETIME_SECONDS
+        )
+        for expired_state in tuple(expired_states):
+            del self._entries[expired_state]
+        self._entries[state] = (code_verifier, now)
 
     def pop(self, state: str) -> str | None:
         """Consume a verifier unless its OAuth state is unknown or expired."""