Read provider sign-in

Requires a workspace-bound user OAuth grant with org:write and owner/admin membership. API keys and browser sessions are not accepted. Login challenges are private to the initiating user. Sessions are persisted for recovery across API instances and restarts until expires_at. An uncertain token exchange is not replayed: an explicit restart-required failure means start a fresh login, retaining account_key. After expiry or a 404, start a new login. Provider device codes may expire sooner. Never share login URLs or codes.

_{Scope: org:write}