Provider OAuth redirect target

Where Google and Notion send the human back. NOT for API clients — it is called by a browser redirect and carries no credential of its own.

It sits outside /v2 deliberately: /v2 requires a bearer token and this request cannot have one. Authentication is the signed state handle instead, which binds the authorization to a workspace and a connection.

Always ends in a 302 to the console at /connectors?connected=<id> on success, or ?error=<code> on failure — except when state itself is missing or forged, which is a 400, because there is no connection to attribute the failure to.