Slack reinstalls and OAuth state verification

Slack workspace installs can now be completed multiple times for the same team. The OAuth flow uses a signed state token tied to the user instead of a single-use session value, so reconnecting or reinstalling a workspace no longer fails because of stale state. The install flow also validates that the callback belongs to the user who started it and shows clearer errors when the link expires or was created for a different session.