Start Figma Oauth

Begin the Figma OAuth flow: stash state+PKCE, return the Figma consent URL.

Returns the URL (rather than a redirect) so the FE can call this with its authenticated session and then navigate the browser to Figma — a plain browser navigation to this endpoint would carry no session header.

Masquerade must not reach this. It is a GET that writes, and get_company_id_helper blocks masquerade by method, so the block does not apply: company_id is the effective company, and /callback upserts the token under it — a staffer connecting their own Figma account while wearing a customer's lens keys it to that customer, and cannot then DELETE it, because that route is method-blocked. Nothing enforces this yet; the only caller is the dev-only harness at /admin/feature/figma, which is what keeps it out of reach today. A real Figma UI needs an is_any_masquerading() refusal here and on /callback first — see _refuse_masquerade_vote in backend/api/marketing/guidelines.py for the shape.