Fix repeated Slack installs with signed state tokens

The Slack installation flow now uses a signed, time-bound state token instead of a session value. This fixes repeated installs that previously failed because the installation state could be lost or reused across sessions, and it gives clearer error messages when the install link is expired or was created for a different session.