Cli Callback

WorkOS redirect target for the loopback flow.

Verifies the signed state (the loopback port is trusted only because it is signed — never an attacker-chosen port). On success, mints a single-use one-time code bound to the PKCE challenge and 302s it to the loopback. ANY failure — a WorkOS error redirect (?error= with no code), the code exchange, or minting — instead 302s an ?error= to the loopback so the CLI fails fast rather than hanging until its timeout.