Oauth Callback

Public OAuth redirect target — finishes the handshake, shows the partner a page.

Unauthenticated by design: the partner's browser lands here from the CRM's authorize screen. The state token (unique, unguessable, minted at registration) is what ties the request to a known connection; anything that doesn't match gets a plain-language error page and nothing else.