Wechat Oauth Poll

Opener-page fallback for WeChat web-QR login. The popup's window.opener is severed by open.weixin.qq.com's COOP header, so the callback can't postMessage the result back. Instead the callback's /api/auth/wechat-oauth response is stashed by state; the opener polls here until it appears. Consumed on first hit. No auth — state is the high-entropy CSRF token only the opener + its own popup know.