The provider’s return leg (public)

Where a provider sends the browser after consent — the app’s registered redirect URI. Public by construction: the HMAC-signed state authenticates the request. Exchanges the code, keeps the grant, and answers a small HTML page that hands the result to the admin window that opened it and closes. No token, code or state appears in the page. Connected accounts (docs/source-plane.md § Connected accounts): the brain as an outbound OAuth 2.1 client for the cloud connectors (gdrive, onedrive, dropbox). Answers a bare 404 until SOURCE_PLANE_ENABLED=1 and SOURCE_OAUTH_CLIENT=1; needs SOURCE_CREDENTIAL_ENCRYPTION_KEY — tokens are never stored in the clear.