Approve Endpoint

Mint a single-use authorization code on the consenting user's behalf.

Called SERVER-SIDE by the portal after the human clicks "Allow". Auth is the service-role bridge: the portal presents the service-role key + the X-Customer-User-Id/X-Customer-Org-Id delegation headers, which get_current_user resolves (and _verify_delegation confirms the user is a member of that org) into a synthetic user-principal AuthUser. The user's Supabase JWT itself is never forwarded to mint the code — identity is asserted via the trusted bridge.

Body: {client_id, redirect_uri, response_type:'code', scope, state, code_challenge, code_challenge_method:'S256'}. Returns 200 {code, redirect_uri, state}; the portal 302s the browser to {redirect_uri}?code=..&state=...