Social Callback

Redeem one social code and mint this console's own session.

state is required, and GoTrue delivers it by preserving the query on the redirect_to it was handed. If a provider release ever dropped it instead, every social sign-in would 401 here rather than quietly losing its CSRF check — which is the direction this whole flow is built to fail in.