Complete a CLI sign-in that WorkOS paused for organization selection

The CLI exchanges its loopback authorization code directly with WorkOS. For a user who belongs to an organization, WorkOS answers that exchange with organization_selection_required and a pending authentication token, and the grant that resolves it requires the client secret the CLI must not hold. This route completes that grant for the organization the user chose on the approve page and returns the resulting tokens. WorkOS enforces that the organization is one of the user's memberships.