Oauth Callback

Complete the authorization code flow and persist the user's grant.

Not authentication-gated — the browser arrives from Snowflake cross-site and may carry no cookie, so the acting user comes from the single-use transaction handle, redeemed before any other parameter is trusted. A cookie that does arrive must agree with it, or one member could start a flow and lure another into completing it onto the starter's grant, filing the colleague's Snowflake identity under the starter's account.