Oauth Callback

Handle Google's callback — verify state, exchange code, persist tokens.

On success: redirects to /admin/vendors?connected={env}. On a forged state token: 401 + Sentry breadcrumb. On an expired state token: 400 with a friendly message linking to /admin/vendors to restart.

env is OPTIONAL: Google preserves only code + state across the redirect, not arbitrary query params on the registered redirect_uri. The canonical env source is the Redis state token (which stores {admin_id, env} at init time). If callers DO pass env (e.g. tests, or manual replay), we cross-verify it against the stored value as defense-in-depth.