Kick redirects here with code+state. Exchange the code for tokens (PKCE), fetch the Kick user, subscribe the channel's chat.message.sent event to the webhook, then save the connection.

The event subscription is created BEFORE the DB save so a connection row is never persisted without its subscription_id.

Shared with the destination-connect flow: a dest grant is recognised by its state matching the ISOLATED dest store. If so we handle the destination and return; otherwise we fall through to the chat logic.