Async one-click setup redirect target (public; authenticated by the signed state)

Rail A (async one-click setup) redirect target, distinct from /connect/oauth/callback (Mode C), which discards its one-time token. It consumes the signed single-use state (rail-bound to async), exchanges the code for a durable async grant at the provider API base pinned into the state at start (never re-derived from fresh discovery), applies the template, and persists the encrypted grant so the connection can be re-applied / reverted server-side. Records are applied with data.via = async.