Teams Oauth Callback

Azure AD consent redirect: verify state, redeem the code, persist the install, then bounce the browser back to the dashboard with a success/error flag (so the admin lands in-app, not on raw JSON).

The page it bounces to rides in the signed state, narrowed to an exact allowlist, and falls back to workspace settings.

Azure also sends tenant / admin_consent query params; they are intentionally not consumed: the tenant is taken from the verified code exchange, not the redirect.