Github Link Callback

Return leg of the in-app claim (a github.com redirect, NO bearer). Verify the session-bound state + double-submit cookie, exchange the code for an EPHEMERAL user token, prove installation control via GET /user/installations (+ org admin), and bind to the state's tenant. The token is never stored. Every outcome clears the cookie and redirects into the app -- never a raw error page.