Build the WorkOS authorization URL and redirect.

• org_slug — when present, the start endpoint looks up the Organization's WorkOS organization id and routes through the tenant SSO connection, ignoring provider. When absent, routes through one of WorkOS's built-in social providers.
• provider — one of _SOCIAL_PROVIDERS. Defaults to Google so links minted before this parameter existed keep working.
• frontend_origin — explicit browser origin. Required for browser logins and must match ALLOWED_FRONTEND_ORIGINS. Used to pick the callback host for dashboard-vs-cloud logins.
• next — post-login redirect target on the frontend. Validated to root-relative paths only.
• callback_port — when present, the success path will redirect to http://localhost:<port>/callback instead of setting a browser cookie. Used by qli login and the Electron app.