do not render the frame before its session exists

Saving the connection showed an error that a refresh then cleared. The effect
that re-mints the frame session re-ran, but `state` was left at 'ready' from
the previous pass — so the iframe mounted immediately, before the cookie
existed, and the first request inside it answered 401. By the time anyone
refreshed, the mint had finished.

A stale 'ready' is worse than a spinner: it renders something broken
confidently.

Also stays on the form after the URL-only step, where there is still a token to
set. Bouncing to a frame that immediately sends you back is worse than not
moving.

web/GiteaFrame.tsx

@@ -38,6 +38,15 @@ export const GiteaFrame = () => {
 
   useEffect(() => {
     let cancelled = false;
+    // BACK TO 'opening' on every re-run, not just the first.
+    //
+    // Without this, saving the connection left `state` at 'ready' from the previous pass, so the iframe
+    // mounted immediately — before the session cookie for it had been minted. The first request inside
+    // the frame answered 401 and showed an error that a refresh then cleared, because by then the mint
+    // had finished.
+    //
+    // A stale 'ready' is worse than a spinner: it renders something broken confidently.
+    setState('opening');
     // Not in a dependency array: `useClient()` returns a new object every render, so depending on `get`
     // or `post` would re-run this on every keystroke elsewhere in the app.
     void (async () => {