fix(saml): preserve the login callback on ACS errors

[appflowy]

When an SP-initiated SAML login fails at the ACS endpoint, GoTrue currently sends the error to GOTRUE_SITE_URL, even when the login requested an allowed browser callback. With a desktop SiteURL, the browser opens AppFlowy Desktop and hides the original SAML error behind its generic login message.

Preserve the allowlisted callback from the server-stored RelayState before expiry checks and consumption, and use it for subsequent ACS errors. Keep the existing OAuth error fields and retain SiteURL fallback for absent, unknown, or disallowed callbacks. Callback form parameters, Referer headers, and IdP-supplied URLs cannot choose the error redirect.

Validation: go test ./internal/api -run '^TestSSO$' -count=1 passed against a disposable PostgreSQL 16 database. The new regression reproduced the browser-to-desktop redirect before the fix and covers validation failure after state consumption, expired state, desktop callbacks, allowlist rejection, and missing/untrusted state. No schema changes.

This change requires a rebuilt GoTrue image. A missing RelayState still cannot recover its callback; signup policy and assertion validation are unchanged.