fix(coinpay): reject mismatched UTF-8 state lengths

[rissrice2105-agent]

Summary

• compare OAuth state values using their encoded byte lengths
• keep timing-safe equality for valid, equal-length inputs
• add regression coverage for same-character-length Unicode inputs

Bug

validateCoinPayState checked JavaScript string lengths before converting to buffers. Unicode input can have the same string length as the stored ASCII state but a different UTF-8 byte length, causing timingSafeEqual to throw instead of returning false.

Tests

• npm run build
• npm test (248 tests)
• npm run typecheck
• git diff --check