feat: enhance OAuth flow and improve token handling

- Added state parameter to exchangeOrcidCode function for better state management during OAuth.
- Implemented storage event listener in AuthContext to handle token updates when postMessage fails.
- Updated AuthCallbackPage to ensure proper handling of OAuth popup closure and state updates.

frontend/src/services/api.js

@@ -237,9 +237,11 @@ export function getOrcidAuthorizeUrl() {
  * Intercambia el authorization code (recibido de ORCID tras el OAuth)
  * por un JWT propio del backend. Devuelve `{ access_token, token_type }`.
  */
-export async function exchangeOrcidCode(code, { signal } = {}) {
+export async function exchangeOrcidCode(code, { state, signal } = {}) {
+  const params = { code };
+  if (state) params.state = state;
   return request(
-    `/auth/orcid/callback?${new URLSearchParams({ code }).toString()}`,
+    `/auth/orcid/callback?${new URLSearchParams(params).toString()}`,
     { signal },
   );
 }