Notion Oauth Callback

Exchange the authorization code for tokens, persist on the connection.

State carries org_id + a timestamp (max 5 min old) and is HMAC-signed with Config.SECRET_KEY. The signature is verified before any field is trusted — without it, a caller who knew another org's id could bind tokens to the wrong org. On success we POST code + grant_type=authorization_code to /v1/oauth/token with HTTP Basic client_id:client_secret. The response includes access_token, refresh_token, workspace_name, workspace_icon, workspace_id, bot_id, and owner — we persist all of those.