Merge commit from fork

* fix: prevent intent token reuse and add expiry

* fix duplicate

* fix expiration

internal/idp/session.go

@@ -2,6 +2,7 @@ package idp
 
 import (
 	"context"
+	"time"
 )
 
 // Session is the minimal implementation for a session of a 3rd party authentication [Provider]
@@ -9,6 +10,7 @@ type Session interface {
 	GetAuth(ctx context.Context) (content string, redirect bool)
 	PersistentParameters() map[string]any
 	FetchUser(ctx context.Context) (User, error)
+	ExpiresAt() time.Time
 }
 
 // SessionSupportsMigration is an optional extension to the Session interface.