Oauth Callback

Handle IdP callback: exchange code, find/create user, redirect to frontend.

The frontend redirect carries a one-time sign-in code, or on a cross-origin deployment the tokens, in the URL fragment. Without explicit-config resolution, an attacker controlling X-Forwarded-Host could steer the post-callback redirect to attacker.com and capture them. Force explicit-config resolution by passing for_external_use=True.