Complete social login

Consumes a short-lived completion token once, resolves or safely links the immutable identity, accepts a bound invitation when applicable, and returns the standard login or MFA-required shape. Microsoft first links require HitKeep email confirmation unless an authenticated session or valid invitation proves the account.