Oauth Confirm Link

Finalize a link_required handoff.

The callback handed the browser a short ticket because the OAuth email matched an existing account that had no identity bound for this provider. The user re-authenticated through any pre-existing factor (password or already-linked OAuth) and POSTs back here with the ticket. We require that the authenticated principal matches the ticket's user_uuid — this is the security gate that prevents account-takeover via provider-side email reassignment.