Link Callback

OAuth return handler.

The provider redirects the user back here with ?code=<grant>&state=<our_state>. If user denies on provider side, we get ?error=access_denied.

This endpoint is UNAUTHENTICATED — we identify the user from the persisted state row, not from session. That's the whole point of storing state in the DB: the callback must work even across a browser new-tab / in-app-browser flow where cookies don't roundtrip.

Security properties:

• State must exist, not be consumed, not be expired.
• State is marked consumed_at on first use → replay-proof.
• On any error, we DON'T tell the user which specific check failed — generic 'link failed' message with ops detail in the log.