Submit the OAuth consent decision (Allow / Deny)

Processes the consent form. On Allow, mints a single-use, 60-second authorization code bound to the client, the exact redirect_uri, and the PKCE challenge, then redirects back to the client with code + state. On Deny, redirects with error=access_denied. CSRF-protected (SameSite=Lax cookie + signed token); the acting org is bound here and is immutable for tokens minted from the code.