OAuth redirect landing. Authenticated by its signed state, not a bearer key.

The provider sends the owner's browser here, so no Authorization header can exist; the state is the credential. It is verified in constant time, expires, and is spendable once, while the connection is still pending. Every refusal is the same not_found, so nothing about a connection id, an expiry, or a replay is disclosed. Do not retry a not_found; start again with POST /v1/connections. On success the token is sealed and the connection becomes active. Requires the explicitly minted bernayser:write scope; bernayser:read permits safe projections and bernayser:write permits mutations. This BERNAYSER operation is quota-neutral. While dark it returns not_found, and a valid key without the required scope receives scope_missing. Fix a non-retryable request or credential before retrying; for rate_limited or service_unavailable, wait for retry_after_sec and retry once.