Finish an install the browser has just come back from.

Called by the frontend, not by the browser: the provider redirects the browser to the frontend's own origin, which is the only place that holds both the session and the nonce cookie. The frontend reads its cookie and hands the raw nonce here (CLO-890).

Every outcome but an unknown provider is a 200 carrying a coarse slug. The caller turns that into whatever the reader sees; the provider's own error text stays in the log, where it is useful and not readable by whoever holds the browser.

For a connector whose code came from link_existing's OAuth leg rather than an app-installation callback (no installation_id, see _complete_link_existing), this never writes a credential itself: it always answers choose_installation with a choice_token, even for zero or one installation, so the tenant owner picks explicitly on POST /{provider}/link rather than this route silently choosing on their behalf (CLO-627).