Slack Oauth Install

Redirect to Slack's authorize URL with an HMAC-signed, short-TTL marketing state.

This is the public "Add to Slack" entry point for the marketing site. The signed state carries NO tenant_id so the OAuth callback routes through the marketing-site resolver (resolve_or_create_workspace) instead of the tenant-attach path. A fresh nonce is sealed into the state AND dropped as an HttpOnly cookie; the callback requires the two to match, binding the round-trip to this browser (OAuth-CSRF defense). Dashboard-initiated installs (where the workspace must be bound to an existing tenant) use the authenticated POST /v1/integrations/slack/install-url endpoint instead, which requires integrations:edit and takes the tenant from the bearer token.

The ad click ids (appended by the marketing site from its stored copies, one per major platform, see AdClickIdsProps) are sealed into the signed state so the callback can stamp them on the platform_installed / workspace_created funnel events. They are NORMALIZED, never validated: normalize_click_id strips and truncates so a junk or over-long value is dropped or trimmed. Rejecting one would let an attribution artifact 422 the public install entry point, which must always reach Slack.