Exchange an OAuth authorization code for a user identity and act on it.

Expected request body (JSON): { "provider": "google" | "twitter", "code": "<authorization code from provider>", "state": "<state token returned by oauth_start>" }

Outcomes (all 200 on success):

1. SocialAccount exists for (provider, provider_uid):

   • Updates last_login, logs UserLoginEvent, issues JWT cookies.
   • Returns: {"status": "authenticated", "user": <profile>}

2. No SocialAccount + request.user is authenticated:

   • Creates SocialAccount linked to the current user.
   • Returns: {"status": "linked", "user": <profile>, "provider": ..., "display_identifier": ...}

3. No SocialAccount + unauthenticated:

   • Deletes any existing PendingAccountClaim for this (provider, uid).
   • Creates a new PendingAccountClaim with _CLAIM_TTL_HOURS expiry.
   • Returns: {"status": "claim_needed", "claim_token": "<uuid>", "display_identifier": ...}

Returns 400 on: missing fields, invalid/expired state, OAuthError from provider.