Connection errors now pinpoint the safe stage

Useful answers without sensitive data

OAuth diagnostics now record only the connection stage, a fixed origin class, a browser fetch class, and a standard error code. Authorization codes, refresh credentials, request tokens, user content, and raw headers never enter the log.