Entra Callback

Exchange the code, issue the session, and hand tokens to the dashboard.

One callback path serves two purposes, dispatched by the VERIFIED contents of the signed state, exactly as the Slack callback does. Sharing the path is deliberate: a second callback would need a second redirect_uri, which is a change to the live Entra app registration.

The connect-redemption purpose is checked first and is a strictly separate branch — it never reaches service.complete and therefore never reaches AuthService.login_with_identity, which creates a User and activates a pending membership. Proving who asked for a connect link must do neither.