feat: self-close sign-in popup via _target_url=/login/close

feat: delegate HF OAuth to gradio.oauth.attach_oauth

fix: harden OAuth callback token exchange against 502s

fix: add response_type=code to HF authorize request

fix: OAuth state round-trip via signed URL state; HF button at sidebar top