Changes to OAuth callback for identity providers that POST the authorization code as form fields (Apple form_post). Apple's first-auth `user` JSON is parsed and carried to identity storage; the form `id_token` is ignored. Web login exchanges code via PKCE and does not treat a form id_token as proof.