fix: Correct OAuth parameter order in init_session

Explicit inputs must come before auto-injected OAuth parameters.
This fixes the "Max challenge attempts exceeded" error.

app.py

@@ -922,8 +922,8 @@ def create_demo() -> gr.Blocks:
 
         # Initialize session on load
         def init_session(
-            profile: gr.OAuthProfile | None,
             current_state: SessionState | None,
+            profile: gr.OAuthProfile | None = None,
         ) -> tuple[list[dict], str, SessionState, gr.Column, gr.Column]:
             """Initialize session state and welcome message."""
             if current_state is None: