fix: second round review fixes for merge UI

- Fix false success toast when response.success is false (CRITICAL)
- Remove mergeToken! non-null assertion in queryFn
- Add early return for missing mergeToken param
- Zero-pad minutes in formatCountdown (MM:SS format)
- Clamp negative seconds in formatCountdown
- Block all unlink buttons while any unlink mutation is pending
- Clear OAuth state only after validation succeeds (not before)
- Split getAndClearLinkOAuthState into read + clear functions

src/pages/ConnectedAccounts.tsx

@@ -106,6 +106,7 @@ export default function ConnectedAccounts() {
   const canUnlink = (provider: LinkedProvider): boolean => {
     if (!provider.linked) return false;
     if (!isOAuthProvider(provider.provider)) return false;
+    if (unlinkMutation.isPending) return false;
     const linkedCount = data?.providers.filter((p) => p.linked).length ?? 0;
     return linkedCount > 1;
   };