OAuth2 provider redirect callback

Public / session-less — called by the OAuth provider's browser redirect. Authenticity comes from the signed state param (10-minute TTL), never from a bearer token. Always responds with an HTTP redirect to the web app's Settings > Integrations page (?connected=<providerKey> on success, ?error=oauth_denied|oauth_invalid_state|oauth_token_server_rejected|oauth_callback_param_missing|oauth_callback_param_invalid|oauth_exchange_failed on failure) — never a JSON body. Multi-data-center providers (Zoho) also send the account's token server (accounts-server): it must be one of the connector's allow-listed origins, otherwise the connect is refused with oauth_token_server_rejected before any token call. Providers that name the connected tenant in the redirect (QuickBooks Online: realmId) must send it and it must match the connector's pattern, otherwise the connect is refused with oauth_callback_param_missing / oauth_callback_param_invalid, also before any token call.