PKCE callbackExchangeFailed: add benign-vs-attack discriminator (volume-gated, no action yet)

ONLY act if it recurs at volume; 3 hits/30d against 192 logins (~1.5%) as of 2026-08-13, no action taken. Mirrors PLUTO-466's volume-gate. Mismatch is NOT the PLUTO-461 missing-verifier class. 461 = cookie ABSENT, down-tiered to warn, has no attack twin. This = verifier cookie PRESENT but belonging to a newer in-flight flow (cross-tab, or back-button remount, which login-client.tsx oauthPending cannot cover: it is per-component-mount React state). DO NOT down-tier this to warn. A verifier mismatch is also the exact signal an authorization-code-injection attack produces, which is what PKCE exists to detect. Down-tiering retires the only detector we have, invisibly. Real defect is that the two causes are indistinguishable in telemetry: detail today is only {errorStatus:400}, and actorUserId is null by construction (the exchange fails before a session exists), so the one-user-vs-many-users discriminator can never work for this action. Fix = log a discriminator at the exchange-failure site in src/app/auth/callback/route.ts: whether a PKCE verifier cookie was present on the request, and recency of a prior OAuth start from the same browser. Benign class then self-identifies while the attack class keeps paging. If volume triggers this, IP/UA correlation is available from db-pluto-cc. Class-A (auth callback): needs pre-impl audit design-ping + pre-push audit diff review.