Instagram Oauth Complete

Finish an Instagram connect: consume the state, exchange the code, save the account.

Authenticated, and bound to the initiator: the state row names the Clerk user who called /start, and only that user may complete it. A victim who was sent somebody else's connect link is either signed out (the frontend sends them to sign in and they arrive here as themselves) or signed in as someone else — either way the identity check fails before the code is exchanged, so their Instagram account is never linked anywhere.

Answers 200 with status for every flow outcome, including the refusals, because the completion page turns the answer straight into the success or error page and needs the blocked-by details a 4xx would lose.