Summary

• Upgrades the OAuth callback page (/oauth) from plain text to a branded success screen
• Adds RoamJS logo with checkmark badge, fade-in animation, and a Roam-themed cursor badge
• All existing OAuth relay logic is preserved unchanged: trusted-origin postMessage, session POST with error propagation, auto-close behavior

Context

Originally proposed in RoamJS/google#37 but that PR targeted the wrong repo. This PR applies the visual upgrade directly to the live page in the website repo, addressing the review feedback from @mdroidian:

• Trusted origins: Existing postMessage logic with origin whitelist is preserved (no wildcard *)
• Full param relay: All URL params are forwarded via JSON.stringify(params) (not just code+state)
• Desktop error propagation: Session POST includes error/error_description — unchanged

Test plan

• Open /oauth?auth=true locally to verify the visual design renders correctly
• Test full Google OAuth login flow in browser (popup flow)
• Test desktop app flow (session polling path)
• Verify postMessage only targets trusted origins (inspect network/console)